A company runs applications in AWS accounts that are in an organization in AWS Organizations. The applications use Amazon EC2 instances and Amazon S3. The company wants to detect potentially compromised EC2 instances, suspicious network activity, and unusual API activity in its existing AWS accounts and in any AWS accounts that the company creates in the future. When the company detects one of these events, the company wants to use an existing Amazon Simple Notification Service (Amazon SNS) topic to send a notification to its operational support team for investigation and remediation. Which solution will meet these requirements in accordance with AWS best practices?
Select one answer.
Marked answer: A
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose B1
B is the right answer
Chose A2
keywords: compromised EC2 instances, suspicious network activity, and unusual API activity = GuardDuty
Chose A2
When you use GuardDuty with an AWS organization, the management account of that organization can designate any account within the organization as the delegated GuardDuty administrator account. For this administrator account, GuardDuty gets enabled automatically only in the designated AWS Region. This account also has the permission to enable and manage GuardDuty for all of the accounts in the organization within that Region. The administrator account can view the members of and add members to this AWS organization. AWS GuardDuty can detect unusual API activity within existing AWS accounts in an AWS Organization. It monitors AWS CloudTrail event logs, which include records of all API calls made within your AWS environment. GuardDuty analyzes these logs to identify unusual or suspicious API activity that might indicate a potential security threat.
