Question
What data sources does GuardDuty analyze?
Click to reveal answer
Answer
CloudTrail management + S3 data events, VPC Flow Logs, DNS logs, EKS audit logs, Lambda network activity, and RDS login activity. Does not require you to enable these separately.
Click to flip back
All Detection & Response Flashcards
Q: What data sources does GuardDuty analyze?
A: CloudTrail management + S3 data events, VPC Flow Logs, DNS logs, EKS audit logs, Lambda network activity, and RDS login activity. Does not require you to enable these separately.
Q: What is ASFF (AWS Security Finding Format)?
A: Standardized JSON format for security findings in Security Hub. All integrated services (GuardDuty, Inspector, Config, etc.) normalize findings to ASFF.
Q: How do you automate GuardDuty finding response?
A: GuardDuty finding → EventBridge rule (filter by finding type/severity) → Lambda/Step Functions for containment/notification. Example: auto-isolate EC2 on high-severity finding.
Q: What is CloudTrail log file validation?
A: Creates a digest file every hour with hash of each log file. Allows you to detect if logs were modified or deleted after delivery. Use aws cloudtrail validate-logs.
Q: What is the difference between GuardDuty and Detective?
A: GuardDuty detects threats (alerts). Detective investigates findings by analyzing behavior graphs (who did what, when, entity relationships). Detective builds on GuardDuty data.
Q: How do you forensically investigate a compromised EC2?
A: 1. Tag instance, 2. Isolate (change SG to no ingress/egress), 3. Snapshot all EBS volumes, 4. Capture memory (SSM), 5. Copy metadata, 6. Terminate or keep for investigation.
Q: What is Security Hub cross-region aggregation?
A: Designate a home region that aggregates findings from all linked regions. Provides single-pane view of security posture across all regions.
Q: How do you detect credential compromise?
A: GuardDuty: UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration. CloudTrail: unusual API calls, new regions, credential used from unexpected IP.
Q: What is Config auto-remediation?
A: Config rule evaluates resource → non-compliant → triggers SSM Automation document to fix (e.g., enable encryption, add tags, restrict SG). Automatic or with approval.
Q: What is Amazon Inspector?
A: Automated vulnerability scanning for EC2 (CVEs), Lambda (code dependencies), and ECR images. Continuous scanning — findings sent to Security Hub.