Amazon GuardDuty Threat Detection – SAP-C02 Study Guide

Purpose of This Lesson

Amazon GuardDuty is an AWS threat detection service that continuously analyzes activity in an AWS environment. Its purpose is to identify indicators of compromise, malicious reconnaissance, and suspicious behavior involving resources such as AWS accounts, Amazon EC2 instances, and Amazon S3 buckets.

For the exam, GuardDuty is primarily a service-identification topic: recognize when a scenario requires managed, intelligent detection of potentially malicious activity rather than preventive access control or configuration auditing.

Key Concepts

Managed threat detection

GuardDuty analyzes security-related activity and generates findings when it detects potentially malicious or unauthorized behavior. It is designed to help identify threats such as:

• Compromise of an AWS account
• Compromise of an Amazon EC2 instance
• Malicious reconnaissance activity
• Suspicious or potentially compromised Amazon S3 activity

GuardDuty is a detection service. It does not replace identity policies, network controls, encryption, or host-level security controls.

Data sources analyzed by GuardDuty

GuardDuty uses activity and telemetry from several AWS sources, including:

• AWS CloudTrail management events: API activity involving AWS resources and account administration
• Amazon S3 data events: Object-level activity such as access to S3 objects
• VPC Flow Logs: Network traffic metadata for activity involving resources in a VPC
• DNS logs: DNS query activity that can help identify communication with suspicious domains

These sources allow GuardDuty to correlate account activity, network behavior, DNS requests, and S3 object access when looking for threats.

GuardDuty findings

When GuardDuty identifies suspicious activity, it produces a security finding. Findings can be investigated and used to drive operational response workflows. A finding is an indication that activity may be malicious or unauthorized; it is not itself proof that a resource has been compromised.

Exam-Relevant Takeaways

• Choose Amazon GuardDuty when the requirement is continuous, managed threat detection across an AWS environment.
• GuardDuty can identify suspicious behavior involving AWS accounts, EC2 instances, and S3 buckets.
• Important telemetry includes CloudTrail management events, S3 data events, VPC Flow Logs, and DNS logs.
• GuardDuty is focused on detecting threats, not preventing access or assessing infrastructure configuration compliance.
• If a question asks for centralized detection of potentially malicious activity with minimal infrastructure management, GuardDuty is a strong candidate.

Architecture Decision Guide

Requirement	Appropriate AWS service or feature	Why
Detect suspicious API activity, reconnaissance, or possible account compromise	Amazon GuardDuty	Provides managed, intelligent threat detection using AWS activity and network telemetry
Record AWS API activity for investigation and auditing	AWS CloudTrail	Captures account and resource API activity; GuardDuty can analyze relevant CloudTrail events
Detect noncompliant resource configurations	AWS Config	Evaluates resources against configuration rules; this is different from threat detection
Enforce who can access AWS resources	AWS Identity and Access Management (IAM)	Uses identities, policies, and permissions to control access
Analyze network traffic metadata	VPC Flow Logs	Provides flow-level network information; GuardDuty can use this telemetry for detection
Monitor S3 object-level activity	CloudTrail S3 data events and Amazon GuardDuty	S3 data events provide object activity, while GuardDuty analyzes relevant behavior for threats

Common Exam Traps

• Confusing GuardDuty with CloudTrail: CloudTrail records API activity. GuardDuty analyzes security-relevant telemetry to identify potential threats.
• Confusing GuardDuty with AWS Config: AWS Config evaluates resource configuration and compliance. GuardDuty focuses on malicious or suspicious activity.
• Treating GuardDuty as a preventive control: GuardDuty detects and reports threats; it does not automatically replace IAM policies, security groups, or other preventive controls.
• Overlooking S3 data events: GuardDuty-related scenarios may involve suspicious object access in S3, not just bucket configuration.
• Selecting a host-based intrusion detection system by default: GuardDuty is an AWS-managed detection service and is appropriate when the requirement is broad AWS threat detection without deploying agents across hosts.

Real-World Engineer Notes

GuardDuty is most useful as part of a layered security architecture. Preventive controls such as IAM, security groups, and encryption reduce the likelihood and impact of an attack, while GuardDuty provides detection when suspicious activity occurs.

A practical security workflow often routes GuardDuty findings to a centralized security operations process for triage and response. Findings should be validated and prioritized based on affected resources, activity type, and business impact.

When investigating an alert, correlate GuardDuty findings with CloudTrail records, VPC Flow Logs, DNS activity, and application or operating system logs. GuardDuty identifies suspicious patterns, but complete incident analysis may require additional evidence.

Quick Reference Summary

• Service: Amazon GuardDuty
• Primary purpose: Managed, continuous threat detection
• Detects: Account compromise, EC2 compromise, malicious reconnaissance, and suspicious S3 activity
• Analyzes: CloudTrail management events, S3 data events, VPC Flow Logs, and DNS logs
• Category: Detection and response
• Not a replacement for: IAM, network controls, encryption, CloudTrail, or configuration compliance services

Flashcards

1. What is the primary purpose of Amazon GuardDuty?

To provide managed, continuous detection of potentially malicious or unauthorized activity in an AWS environment.

2. What types of threats can GuardDuty identify?

Potential AWS account compromise, EC2 instance compromise, malicious reconnaissance, and suspicious or potentially compromised S3 activity.

3. Does GuardDuty prevent unauthorized access?

No. GuardDuty detects and reports suspicious activity. Preventive controls include IAM policies, security groups, network controls, and encryption.

4. What CloudTrail information can GuardDuty analyze?

CloudTrail management events, which record API activity involving AWS resources and account administration.

5. Why are S3 data events relevant to GuardDuty?

They provide object-level visibility, such as access to S3 objects, which can help identify suspicious activity involving S3 data.

6. What network telemetry can GuardDuty use?

VPC Flow Logs, which provide metadata about network flows within a VPC.

7. Why does GuardDuty analyze DNS logs?

DNS query activity can reveal communication with suspicious or malicious domains and contribute to threat detection.

8. How does GuardDuty differ from AWS Config?

GuardDuty detects suspicious activity and threats, while AWS Config evaluates resource configuration and compliance.

9. How does GuardDuty differ from CloudTrail?

CloudTrail records AWS API activity. GuardDuty analyzes relevant telemetry, including CloudTrail events, to identify potential threats.

10. What kind of exam wording suggests GuardDuty?

A requirement for managed, continuous, intelligent detection of suspicious activity or possible compromise across AWS accounts and resources.

Practice Questions

Question 1

A security team wants a managed AWS service that continuously monitors account activity, network behavior, DNS queries, and S3 activity to identify signs of compromise and malicious reconnaissance. Which service meets this requirement?

• A. AWS Config
• B. Amazon GuardDuty
• C. AWS CloudTrail
• D. Amazon Inspector

Correct answer: B. Amazon GuardDuty

Explanation: GuardDuty is a managed threat detection service that analyzes sources such as CloudTrail management events, S3 data events, VPC Flow Logs, and DNS logs. CloudTrail records API activity, while Config evaluates resource configuration.

Question 2

An organization needs to determine whether its EC2 instances may be communicating with suspicious destinations and whether its AWS account is exhibiting signs of compromise. The organization wants to avoid deploying and maintaining detection infrastructure. Which solution is most appropriate?

• A. Amazon GuardDuty
• B. AWS IAM Access Analyzer
• C. AWS Config
• D. Amazon S3 server access logging

Correct answer: A. Amazon GuardDuty

Explanation: GuardDuty provides managed threat detection for suspicious account, EC2, network, and DNS activity. The other options address permissions analysis, configuration compliance, or S3 access logging rather than broad threat detection.

Question 3

A solutions architect is selecting a service for each security requirement. Which requirement should be assigned to Amazon GuardDuty?

• A. Automatically deny API calls that do not meet an identity policy
• B. Verify that security groups comply with an organizational standard
• C. Detect potential malicious reconnaissance and account compromise
• D. Record all AWS API calls for long-term audit retention

Correct answer: C. Detect potential malicious reconnaissance and account compromise

Explanation: GuardDuty is designed to detect threats and suspicious behavior. IAM handles authorization, AWS Config evaluates compliance, and CloudTrail records API activity for auditing and investigation.

Question 4

A security engineer is reviewing a GuardDuty finding involving suspicious access to objects in an S3 bucket. Which telemetry is especially relevant to this investigation?

• A. S3 data events
• B. AWS Config configuration history only
• C. IAM password policy settings
• D. Route table associations only

Correct answer: A. S3 data events

Explanation: S3 data events provide object-level activity, such as access to objects in a bucket. GuardDuty can use this information when detecting suspicious S3 behavior.