AWS Service for ML-based Log Analysis and Security Investigation

CLF-C02 By islever Editorial Last updated

Identify AWS artificial intelligence and machine learning (AI/ML) services and analytics services.

Short answer

C Amazon Detective uses machine learning to analyze log data and visualize security investigations.

Question

A company wants to use machine learning capabilities to analyze log data from its Amazon EC2 instances and efficiently conduct security investigations. Which AWS service will meet these requirements?
  1. Amazon Inspector
  2. Amazon QuickSight
  3. Amazon Detective - Correct Answer

Key Takeaways

The question tests the distinction between threat detection (GuardDuty) and security investigation/analysis (Detective), with the trap being their shared use of ML on logs.

Amazon Detective is the correct AWS service for analyzing log data with machine learning to conduct security investigations. This page clarifies why it is preferred over GuardDuty for investigation tasks.

Common mistake: Many learners choose Amazon GuardDuty because it uses ML and analyzes logs, but they miss that GuardDuty detects threats while Detective investigates root causes.

Expert Analysis

Why the Answer Is Correct

Amazon Detective is a fully managed service that automatically collects log data from your AWS resources and uses machine learning, statistical analysis, and graph theory to build a linked set of data that enables you to easily conduct security investigations. It helps identify the root cause of suspicious activities by visualizing relationships between entities in your environment.

Why the Other Options Are Wrong

Amazon Inspector is an automated security assessment service that finds vulnerabilities in EC2 instances, not for general log analysis or investigation. Amazon QuickSight is a business intelligence tool for creating dashboards and reports, not a specialized security investigation service. Amazon GuardDuty is a threat detection service that identifies potential unauthorized activity using ML, but its primary role is detection and alerting rather than deep investigation and root cause analysis.

Community Comment Notes

Community consensus strongly supports Amazon Detective, with most users citing its ability to 'automatically collect log data' and 'identify root cause'. One user noted that while GuardDuty detects threats, Detective provides the interactive visualizations needed for investigation. Another user clarified that Detective builds a 'linked set of data' which is key for investigating complex issues.

Official Reference

https://docs.aws.amazon.com/detective/latest/userguide/what-is-detective.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question mentions 'investigation', 'root cause', or 'visualizing relationships' in a security context, think of Detective. When it mentions 'continuous monitoring' or 'alerting' for threats, think of GuardDuty.

Frequently Asked Questions

Why not Amazon GuardDuty for this scenario?

GuardDuty detects threats and sends alerts, but Detective investigates the root cause using ML and graph theory on collected logs.

Does Detective replace GuardDuty?

No, Detective can analyze findings from GuardDuty, but it is designed for investigation, not continuous threat detection.

More CLF-C02 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. Asylgul 👍 4 Answered C
    C. Amazon Detective Amazon Detective makes it easy to analyze, investigate, and quickly identify the root cause of security issues or suspicious activities. It automatically collects log data from your AWS resources and uses machine learning, statistical analysis, and graph theory to build a linked set of data that enables you to easily conduct investigations. While Amazon GuardDuty is effective for detecting threats, Amazon Detective specializes in analyzing and investigating the security findings that GuardDuty and other services detect, making it an excellent choice for efficiently conducting security investigations with machine learning capabilities.
  2. chalaka 👍 2 Answered C
    C. Amazon Detective Amazon Detective is a fully managed service that helps you to investigate potential security issues or suspicious activities across your AWS environment, including EC2 instances. It automatically collects log data from multiple AWS sources, such as VPC Flow Logs, CloudTrail, and GuardDuty findings, and uses machine learning, statistical analysis, and graph theory to build interactive visualizations and make it easier to identify security issues and conduct investigations.
  3. Mark_DeSade 👍 1 Answered C
    C: Amazon Detective A managed security service that helps security analysts investigate security issues. Detective can analyze security findings from multiple sources, including GuardDuty, to help identify the root cause of malicious activity. Detective provides interactive visualizations and insights to help users investigate issues more quickly. Amazon GuardDuty A threat detection service that continuously monitors AWS environments for unauthorized access and malicious activity. GuardDuty provides real-time alerts and detailed findings to help security teams respond to security incidents.
  4. ahadh7621 👍 1 Answered C
    Amazon GuardDuty Amazon GuardDuty is a threat detection service that continuously monitors, analyzes, and processes specific AWS data sources and logs in your AWS environment. GuardDuty uses threat intelligence feeds, such as lists of malicious IP addresses and domains, and machine learning (ML) models to identify unexpected, and potentially unauthorized activity in your AWS environment. This includes the following issues:
  5. alokdixit2006 👍 1 Answered C
    Amazon Detective: 1.Investigate and quickly identify the root cause of potential security issues. 2.Automatically collect log data from your AWS resources and uses machine learning to help you visualize and conduct security investigations.
Show 5 more comments
  1. FormacionIaaS365 👍 1 Answered C
    https://docs.aws.amazon.com/detective/latest/userguide/what-is-detective.html I think the key is this: "Detective automatically collects log data from your AWS resources"
  2. alokdixit2006 👍 1 Answered C
    Amazon Detective is the best service for conducting security investigations using machine learning to analyze log data from Amazon EC2 instances and other AWS resources.
  3. Nikmah 👍 1 Answered C
    correct D: Amazon GuardDuty • Intelligent Threat discovery to protect your AWS Account • Uses Machine Learning algorithms, anomaly detection, 3rd party data
  4. newSJ 👍 1 Answered C
    It's C : https://docs.aws.amazon.com/detective/latest/userguide/what-is-detective.html
  5. d00b229 👍 1
    D Amazon GuardDuty

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which migration strategies move a cloud-incompatible CMS with least effort?

S-grade

Launching Third-Party IDS in AWS

S-grade

Which AWS Support Plan Offers API Access Most Cost-Effectively?

S-grade

S3 Express One Zone for Single-Digit Millisecond Latency

S-grade

Practice All CLF-C02 Questions

Access 120 questions with complete answers and detailed explanations.

View Full CLF-C02 Practice Test →

← Back to CLF-C02 Study Guide