GuardDuty for threat detection in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable GuardDuty in a specific AWS region.

AWS

aws guardduty create-detector --enable [1] --region us-east-1

Drag options to blanks, or click blank then click option'

Atrue

Bfalse

Cenabled

Dyes

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'false' instead of 'true' disables GuardDuty.

Using strings like 'enabled' or 'yes' are invalid for this flag.

To enable GuardDuty, the --enable flag must be set to true.

2fill in blank

medium

Complete the code to list all GuardDuty findings in a detector.

AWS

aws guardduty list-findings --detector-id [1] --region us-west-2

Drag options to blanks, or click blank then click option'

A1234567890abcdef

Benable

Cfindings

Dus-west-2

Attempts:

3 left

💡 Hint

Common Mistakes

Using region name instead of detector ID.

Using command names like 'enable' or 'findings' instead of the ID.

The --detector-id requires the unique detector ID string.

3fill in blank

hard

Fix the error in the command to get details of a specific GuardDuty finding.

AWS

aws guardduty get-finding --detector-id [1] --finding-id 1111-2222-3333 --region us-east-2

Drag options to blanks, or click blank then click option'

Afindings

Benable

Cus-east-2

D1234abcd5678efgh

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'enable' or 'findings' instead of the detector ID.

Using region name in place of detector ID.

The --detector-id must be the actual detector ID string, not a command or region.

4fill in blank

hard

Fill both blanks to create a GuardDuty member account in an organization.

AWS

aws guardduty create-members --detector-id [1] --account-details AccountId=[2],Email=[e-mail] --region us-east-1

Drag options to blanks, or click blank then click option'

Aabcd1234efgh5678

B123456789012

Cus-east-1

Denable

Attempts:

3 left

💡 Hint

Common Mistakes

Using region or 'enable' instead of detector ID.

Using non-numeric or wrong length for AccountId.

The --detector-id needs the detector ID string, and AccountId needs the AWS account number.

5fill in blank

hard

Fill all three blanks to update GuardDuty detector settings.

AWS

aws guardduty update-detector --detector-id [1] --enable [2] --finding-publishing-frequency [3] --region us-west-1

Drag options to blanks, or click blank then click option'

Aefgh5678abcd1234

Btrue

CFIFTEEN_MINUTES

Dfalse

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong detector ID format.

Using strings like 'yes' instead of true/false.

Using invalid frequency values.

The detector ID is a string, --enable expects a boolean, and --finding-publishing-frequency accepts values like FIFTEEN_MINUTES.