GuardDuty for threat detection in AWS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is AWS GuardDuty?

AWS GuardDuty is a security service that continuously monitors your AWS accounts and workloads for malicious or unauthorized behavior to help protect your AWS environment.

intermediate

How does GuardDuty detect threats?

GuardDuty analyzes data from AWS CloudTrail logs, VPC Flow Logs, and DNS logs using machine learning, anomaly detection, and integrated threat intelligence to identify suspicious activity.

intermediate

What types of findings can GuardDuty generate?

GuardDuty findings include unauthorized access attempts, reconnaissance activities, compromised instances, and unusual API calls, helping you quickly identify potential security issues.

intermediate

Can GuardDuty be enabled across multiple AWS accounts?

Yes, GuardDuty supports multi-account management where a master account can manage and view findings from multiple member accounts for centralized threat detection.

beginner

What should you do after GuardDuty generates a finding?

After a finding, review the details in the GuardDuty console, investigate the source, and take appropriate actions such as isolating resources, updating security groups, or rotating credentials.

Which data sources does GuardDuty use to detect threats?

A IAM user passwords

B S3 bucket contents only

C EC2 instance logs only

D CloudTrail logs, VPC Flow Logs, DNS logs

GuardDuty analyzes CloudTrail logs, VPC Flow Logs, and DNS logs to detect suspicious activity.

What is the main benefit of enabling GuardDuty in your AWS account?

A Free data backup service

B Automatic patching of EC2 instances

C Continuous threat detection and alerting

D Cost optimization recommendations

GuardDuty provides continuous monitoring and alerts for potential security threats.

Can GuardDuty findings be shared across multiple AWS accounts?

A Only if accounts are in different regions

B Yes, using a master and member account setup

C No, findings are isolated per account

D Only for accounts with the same billing

GuardDuty supports multi-account management with a master account viewing findings from member accounts.

Which of the following is NOT a type of GuardDuty finding?

A EC2 instance CPU usage spikes

B Unauthorized access attempts

C Unusual API calls

D Reconnaissance activities

GuardDuty does not monitor CPU usage; it focuses on security-related findings.

What is the first step after receiving a GuardDuty finding?

A Review the finding details and investigate

B Delete the affected EC2 instance immediately

C Ignore if the finding is from a trusted IP

D Disable GuardDuty to stop alerts

You should review and investigate findings before taking further action.

Explain how AWS GuardDuty helps protect your cloud environment.

Think about what data GuardDuty looks at and what it does with that data.

Describe the process to respond to a GuardDuty threat detection finding.

Focus on steps after GuardDuty alerts you.