Detection
Free AWS Certified Security – Specialty (SCS-C03) practice — 6 questions on Detection, with explanations. No sign-up. Full 12-question mixed test →
A financial services company runs a multi-account AWS environment with AWS Organizations. Security requires automated detection of IAM policies that grant overly permissive cross-account access. The solution must identify when principals from external accounts are granted access to sensitive S3 buckets, and must differentiate between trusted partner accounts and unknown external accounts. Which solution provides the MOST comprehensive detection capability?
IAM Access Analyzer with organization-level zone of trust is purpose-built for this scenario. Defining the zone of trust as the organization means any access from outside the organization is flagged as an external access finding. Filters allow distinguishing between different types of external access, and Security Hub integration provides centralized detection across all accounts. This is the AWS-native, purpose-built service for detecting cross-account access patterns.
A company's security team needs to detect potential credential compromise by monitoring for unusual API call patterns. They want to identify when IAM credentials are used from geographic locations inconsistent with normal usage, AND when credentials show signs of automated scanning behavior (rapid successive API calls to enumerate resources). Current CloudTrail logs are stored in S3. The detection must occur within 15 minutes of the activity. Which approach provides detection for BOTH scenarios with minimal operational overhead?
GuardDuty is purpose-built for threat detection including the specific scenarios mentioned: UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration, UnauthorizedAccess:IAMUser/TorIPCaller, Recon:IAMUser/MaliciousIPCaller, and PenTest:IAMUser/KaliLinux finding types. It natively analyzes CloudTrail events, VPC Flow Logs, and DNS logs, uses machine learning for anomaly detection including geographic anomalies, and detects reconnaissance patterns automatically. Findings are published within 5-15 minutes meeting the time requirement.
An enterprise security team manages 150 AWS accounts. They need to detect when EC2 instances in production VPCs communicate with known malicious IP addresses or domains. The solution must work for instances without public IPs that route through NAT Gateways, must not require agent installation, and must detect both inbound and outbound connections. Current VPC Flow Logs are enabled and sent to a central S3 bucket. Which solution provides the required detection capability?
GuardDuty natively analyzes VPC Flow Logs for malicious IP communication (Backdoor:EC2/*, UnauthorizedAccess:EC2/*, Trojan:EC2/* finding types) and analyzes DNS logs for queries to malicious domains (Trojan:EC2/DNSDataExfiltration, Backdoor:EC2/C&CActivity.B!DNS). It automatically correlates with AWS threat intelligence and third-party feeds, works without agents, detects both inbound and outbound traffic, and using delegated administrator allows central management across all 150 accounts. Crucially, it works for instances behind NAT Gateways because it analyzes VPC Flow Logs which capture all traffic regardless of public IP presence.
A healthcare company must detect when S3 objects containing protected health information (PHI) are unintentionally exposed. Objects are tagged with 'DataClassification: PHI' upon creation. The company needs to detect: (1) when PHI objects are made public via ACLs or bucket policies, (2) when PHI objects are shared with unauthorized AWS accounts via cross-account access, and (3) when bucket encryption settings for PHI buckets are disabled. Detection must be continuous and automated. Which combination of services provides complete coverage for all three scenarios?
This combination provides complete coverage: AWS Config rules (s3-bucket-public-read-prohibited, s3-bucket-server-side-encryption-enabled) continuously monitor bucket-level settings for public access and encryption on PHI-tagged buckets. IAM Access Analyzer specifically detects cross-account access via bucket policies and ACLs for external principals. Amazon Macie provides both automated sensitive data discovery (detecting PHI content) and monitors for policy changes that expose data - it can detect when objects with PHI are made public or accessible externally through policy analysis and provides findings when sensitive data becomes exposed. Together these cover all three scenarios with purpose-built, continuous monitoring.
A security operations team receives AWS Security Hub findings from GuardDuty, IAM Access Analyzer, and Macie across 80 accounts. They need to automatically suppress findings that match specific criteria: (1) GuardDuty 'Recon:EC2/PortProbeUnprotectedPort' findings from their approved vulnerability scanning CIDR ranges, (2) IAM Access Analyzer findings for S3 buckets intentionally shared with a specific partner account, and (3) Macie findings for objects in a bucket used for security testing. The suppression must not delete findings but must prevent them from appearing in active findings and affecting compliance scores. What is the MOST operationally efficient approach?
Suppressing at the source is most efficient and prevents noise from propagating through the system. GuardDuty suppression rules filter findings at creation based on criteria like finding type, CIDR ranges, tags - matching findings never become active. IAM Access Analyzer archive rules designate specific external access as expected (like trusted partner accounts) and archive those findings automatically. Macie allow lists prevent specific S3 locations or patterns from generating findings. All three mechanisms preserve the finding data (not deleted) but prevent them from appearing as active findings or affecting scores, and this happens before Security Hub ingestion, reducing noise across the entire detection pipeline.
A company runs containerized applications on Amazon ECS Fargate across multiple accounts. Security requires detection of container images with known vulnerabilities before deployment AND runtime detection of containers exhibiting malicious behavior. The solution must integrate with existing CI/CD pipelines (AWS CodePipeline/CodeBuild), provide findings in Security Hub, and detect runtime threats like cryptocurrency mining or unexpected network connections. Which combination meets all requirements?
Amazon Inspector provides comprehensive vulnerability scanning for container images in ECR (CVEs, network reachability) and can be integrated into CI/CD by querying findings via API in CodeBuild to fail builds based on vulnerability severity. GuardDuty ECS Runtime Monitoring (specifically designed for Fargate) detects runtime threats including cryptocurrency mining (CryptoCurrency:Runtime/BitcoinTool.B), unexpected network connections (Backdoor:Runtime/*, Trojan:Runtime/*), and malicious processes without requiring agents (agentless monitoring). Both services natively integrate with Security Hub. This is the AWS-native, fully managed solution covering both requirements.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
$119.99 $34.99 with code FREETEST33 — valid through August 23.
Get my $34.99 deal →