CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS Certified Solutions Architect - Associate Exam Question Walkthrough: Security Monitoring
Explore a key AWS security question and learn how to identify the correct services for real-time monitoring and alerting.
To enhance security for your AWS environment, you want to implement a solution that provides real-time monitoring and alerting for unauthorized access attempts. This decision trips up many candidates because the options can seem similar, but only one combination directly addresses the need for real-time detection.
The question
To enhance security for your AWS environment, you want to implement a solution that provides real-time monitoring and alerting for unauthorized access attempts. Which services should you integrate to achieve this?
A. AWS CloudTrail and Amazon GuardDuty.
B. AWS Config and Amazon Inspector.
C. Amazon CloudWatch and AWS Trusted Advisor.
D. AWS Shield and AWS Firewall Manager.
Think before you scroll
Before selecting an option, consider which services specialize in monitoring and alerting. Focus on those that analyze access attempts and provide alerts in real-time. This will help narrow down your choices.
The answer
The correct option is A. AWS CloudTrail and Amazon GuardDuty. This combination provides the necessary tools for real-time monitoring and alerts regarding unauthorized access by analyzing log data from AWS CloudTrail and threat detection from Amazon GuardDuty.
Why the other options lose
B. AWS Config and Amazon Inspector. While AWS Config helps track resource configurations and compliance, it does not provide real-time monitoring or alerting for unauthorized access. Amazon Inspector focuses on security assessments, which is not the primary need here.
C. Amazon CloudWatch and AWS Trusted Advisor. Amazon CloudWatch monitors resource metrics and can alert on certain thresholds, but it does not specifically monitor unauthorized access attempts. AWS Trusted Advisor offers best practices but lacks real-time security monitoring capabilities.
D. AWS Shield and AWS Firewall Manager. These services focus on DDoS protection and managing firewall rules. They do not provide real-time monitoring or alerting for unauthorized access attempts, which is the core requirement of the question.
The concept behind it
Real-time monitoring and alerting for security incidents require services that log activity and analyze that data for threats. AWS CloudTrail records API calls, while Amazon GuardDuty analyzes this data for anomalies indicating unauthorized access attempts. Together, they form a powerful security solution.
Exam trap to remember
Always prioritize services that monitor and alert over those focused on compliance or performance when dealing with security questions.