How Do You Auto-Detect and Respond to Threats with GuardDuty and WAF?

SAA-C03 By islever Editorial Last updated

Design secure workloads and applications.

Short answer

A Use Amazon GuardDuty for threat detection, then route its findings through Amazon EventBridge to a Lambda function that updates the AWS WAF rules.

Question

A company's web application consists of multiple Amazon EC2 instances that run behind an Application Load Balancer in a VPC. An Amazon RDS for MySQL DB instance contains the data. The company needs the ability to automatically detect and respond to suspicious or unexpected behavior in its AWS environment. The company already has added AWS WAF to its architecture. What should a solutions architect do next to protect against threats?
  1. Use Amazon GuardDuty to perform threat detection. Configure Amazon EventBridge to filter for GuardDuty findings and to invoke an AWS Lambda function to adjust the AWS WAF rules. Correct Answer
  2. Use AWS Firewall Manager to perform threat detection. Configure Amazon EventBridge to filter for Firewall Manager findings and to invoke an AWS Lambda function to adjust the AWS WAF web ACL.
  3. Use Amazon Inspector to perform threat detection and to update the AWS WAF rules. Create a VPC network ACL to limit access to the web application.
  4. Use Amazon Macie to perform threat detection and to update the AWS WAF rules. Create a VPC network ACL to limit access to the web application.

Key Takeaways

The question tests which AWS service performs threat detection and response, with the trap being services that manage policy (Firewall Manager), scan for vulnerabilities (Inspector) or find sensitive data (Macie) rather than detect active threats.

AWS WAF only filters HTTP traffic, so the missing piece is a service that watches the whole AWS environment for malicious behavior and can trigger an automatic response. Amazon GuardDuty provides that threat detection, and Amazon EventBridge plus AWS Lambda can translate its findings into AWS WAF rule updates.

Common mistake: Choosing AWS Firewall Manager (B) because its name suggests security enforcement, when it actually centrally manages WAF/Shield/Security Group policies and is not a threat detection engine.

Expert Analysis

Why the Answer Is Correct

Amazon GuardDuty is AWS's managed threat detection service: it continuously analyzes VPC Flow Logs, AWS CloudTrail management and data events, and DNS query logs to surface findings such as cryptocurrency mining, credential compromise, or communication with known malicious IPs. The question asks for the ability to "automatically detect and respond to suspicious or unexpected behavior," and GuardDuty is the only option that provides that detection layer. Because the company already has AWS WAF in place, the response side is completed by routing GuardDuty findings through Amazon EventBridge to an AWS Lambda function that programmatically updates the WAF rules — the standard automated-remediation pattern in AWS. The architecture therefore keeps WAF as the enforcement point while GuardDuty supplies the intelligence.

Why the Other Options Are Wrong

Option B substitutes AWS Firewall Manager, which is a policy management service for centrally deploying WAF web ACLs, Shield Advanced protections, and security group rules across accounts — it does not perform threat detection or generate behavioral findings. Option C names Amazon Inspector, which is a vulnerability management service that scans EC2 instances, container images, and Lambda functions for software and network reachability issues; it does not update WAF rules, and a VPC network ACL is a stateless subnet-level filter, not an application-layer control. Option D names Amazon Macie, which discovers and classifies sensitive data such as PII in Amazon S3, again with no threat detection or WAF integration, and the same irrelevant network ACL. Only option A pairs a genuine detection service with an automated, event-driven response that adjusts the existing WAF rules.

Community Comment Notes

All four visible commenters selected option A, and their reasoning centers on the phrase "threat detection." Awsbeginner87 offered the mnemonic "Malicious or suspicious activity - think of GuardDuty," while Hkayne stated simply "Threat detection means guarduty." Scheldon quoted the service definition that "Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity" and linked the official GuardDuty features page. zinabu summed it up as "Gard duty for automatic treat detection," reinforcing the detect-and-respond link that the EventBridge and Lambda components complete.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When an SAA-C03 scenario says "automatically detect and respond" and mentions an existing AWS WAF, the answer is almost always GuardDuty findings routed through EventBridge to Lambda for remediation. Scan the options for the service that actually produces findings rather than one that manages policy or scans for vulnerabilities.

Frequently Asked Questions

Why is AWS Firewall Manager wrong for detecting suspicious behavior here?

Firewall Manager centrally deploys and manages WAF web ACLs, Shield Advanced protections, and security group policies across accounts; it is a management plane, not a behavioral threat detection engine that produces findings.

Does Amazon Inspector update AWS WAF rules automatically?

No. Inspector only scans EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure, and it has no integration that rewrites AWS WAF rules.

More SAA-C03 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Awsbeginner87 👍 5 Answered A
    Malicious or suspicious activity - think of GuardDuty
  2. Scheldon 👍 4 Answered A
    AnswerA Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across your AWS environment. https://aws.amazon.com/guardduty/features/
  3. Hkayne 👍 4 Answered A
    Threat detection means guarduty
  4. zinabu 👍 3 Answered A
    Gard duty for automatic treat detection

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide