Practice Test 1 | AWS Certified Cloud Practitioner | CLF-C01 | Dumps | Mock Test

Correct Answer: A

Amazon Detective can be used to identify the root cause of the potential security threat. It collects & analyses data from multiple sources like AWS CloudTrail logs, VPC Flow logs, and Amazon GuardDuty findings. Based upon unified findings created by Amazon Detective, the Security Team can quickly determine the root cause of the security threat.

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads.

AWS Security Hub aggregates alerts from various services like Amazon GuardDuty, Amazon Inspector, Amazon Macie, and AWS Partner solutions in a single place.

• Option B is incorrect as AWS Shield is a managed DDoS protection service that detects DDoS attacks & provides mitigation for the same. This service is not suitable for investigating the root cause of potential security threats on AWS resources. 
• Option C is incorrect as Amazon GuardDuty is a threat detection service that monitors logs from AWS CloudTrail Event logs, Amazon VPC Flow Logs, and DNS Logs to detect any malicious activity.
• Option D is incorrect as AWS Security Hub aggregates alerts from various services like Amazon GuardDuty, Amazon Inspector, Amazon Macie, and AWS Partner solutions in a single place.

For more information on Amazon Detective, refer to the following URL,

• https://aws.amazon.com/detective/faqs/
• https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html
• https://aws.amazon.com/guardduty/faqs/