GuardDuty for threat detection in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable GuardDuty in a specific AWS region.

AWS

aws guardduty create-detector --enable [1] --region us-east-1

Drag options to blanks, or click blank then click option'

Atrue

Bfalse

Cenabled

Dyes

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'false' instead of 'true' disables GuardDuty.

Using strings like 'enabled' or 'yes' are invalid for this flag.

To enable GuardDuty, the --enable flag must be set to true.

2fill in blank

medium

Complete the code to list all GuardDuty findings in a detector.

AWS

aws guardduty list-findings --detector-id [1] --region us-west-2

Drag options to blanks, or click blank then click option'

A1234567890abcdef

Benable

Cfindings

Dus-west-2

Attempts:

3 left

💡 Hint

Common Mistakes

Using region name instead of detector ID.

Using command names like 'enable' or 'findings' instead of the ID.

The --detector-id requires the unique detector ID string.

3fill in blank

hard

Fix the error in the command to get details of a specific GuardDuty finding.

AWS

aws guardduty get-finding --detector-id [1] --finding-id 1111-2222-3333 --region us-east-2

Drag options to blanks, or click blank then click option'

Afindings

Benable

Cus-east-2

D1234abcd5678efgh

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'enable' or 'findings' instead of the detector ID.

Using region name in place of detector ID.

The --detector-id must be the actual detector ID string, not a command or region.

4fill in blank

hard

Fill both blanks to create a GuardDuty member account in an organization.

AWS

aws guardduty create-members --detector-id [1] --account-details AccountId=[2],Email=[e-mail] --region us-east-1

Drag options to blanks, or click blank then click option'

Aabcd1234efgh5678

B123456789012

Cus-east-1

Denable

Attempts:

3 left

💡 Hint

Common Mistakes

Using region or 'enable' instead of detector ID.

Using non-numeric or wrong length for AccountId.

The --detector-id needs the detector ID string, and AccountId needs the AWS account number.

5fill in blank

hard

Fill all three blanks to update GuardDuty detector settings.

AWS

aws guardduty update-detector --detector-id [1] --enable [2] --finding-publishing-frequency [3] --region us-west-1

Drag options to blanks, or click blank then click option'

Aefgh5678abcd1234

Btrue

CFIFTEEN_MINUTES

Dfalse

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong detector ID format.

Using strings like 'yes' instead of true/false.

Using invalid frequency values.

The detector ID is a string, --enable expects a boolean, and --finding-publishing-frequency accepts values like FIFTEEN_MINUTES.

Practice

1. What is the main purpose of AWS GuardDuty?

easy

A. To manage user permissions and access control

B. To automatically detect threats and suspicious activity in your AWS environment

C. To store and backup data securely

D. To deploy applications automatically

Solution

1. Step 1: Understand GuardDuty's role

   GuardDuty is a security service that watches your AWS environment for threats.

2. Step 2: Compare options

   Only To automatically detect threats and suspicious activity in your AWS environment describes threat detection, which is GuardDuty's main function.

3. Final Answer:

   To automatically detect threats and suspicious activity in your AWS environment -> Option B

4. Quick Check:

   GuardDuty = Threat detection [OK]

Hint: GuardDuty = automatic threat detection service [OK]

Common Mistakes:

• Confusing GuardDuty with access management
• Thinking GuardDuty stores data
• Assuming GuardDuty deploys apps

2. Which AWS service must be enabled to start using GuardDuty?

easy

A. AWS CloudTrail

B. AWS IAM

C. AWS Config

D. Amazon GuardDuty

Solution

1. Step 1: Identify the service to enable

   GuardDuty is a separate AWS service that must be enabled to start threat detection.

2. Step 2: Check other services' roles

   CloudTrail logs events, Config tracks resource changes, IAM manages permissions, but none start GuardDuty.

3. Final Answer:

   Amazon GuardDuty -> Option D

4. Quick Check:

   Enable GuardDuty service to start detection [OK]

Hint: Enable GuardDuty service itself to start detection [OK]

Common Mistakes:

• Confusing CloudTrail with GuardDuty
• Thinking IAM enables GuardDuty
• Assuming Config starts GuardDuty

3. After enabling GuardDuty, which of the following best describes what happens next?

medium

A. GuardDuty disables CloudTrail to reduce noise

B. You must manually upload logs for GuardDuty to analyze

C. GuardDuty immediately starts analyzing AWS logs and network activity for threats

D. GuardDuty automatically deletes suspicious resources

Solution

1. Step 1: Understand GuardDuty's automatic behavior

   GuardDuty automatically analyzes AWS logs and network data once enabled.

2. Step 2: Evaluate other options

   Manual log upload is not needed, CloudTrail is not disabled, and GuardDuty does not delete resources.

3. Final Answer:

   GuardDuty immediately starts analyzing AWS logs and network activity for threats -> Option C

4. Quick Check:

   GuardDuty auto-analyzes logs after enablement [OK]

Hint: GuardDuty auto-analyzes logs; no manual upload needed [OK]

Common Mistakes:

• Thinking manual log upload is required
• Believing GuardDuty disables CloudTrail
• Assuming GuardDuty deletes resources

4. You enabled GuardDuty but are not receiving any findings. What is a likely cause?

medium

A. GuardDuty is not enabled in the correct AWS region

B. You forgot to create an IAM user

C. CloudTrail is disabled globally

D. GuardDuty requires manual log uploads

Solution

1. Step 1: Check GuardDuty regional enablement

   GuardDuty must be enabled in each AWS region to detect threats there.

2. Step 2: Review other options

   IAM user creation is unrelated to findings, CloudTrail is enabled by default in most regions, and GuardDuty does not require manual uploads.

3. Final Answer:

   GuardDuty is not enabled in the correct AWS region -> Option A

4. Quick Check:

   GuardDuty region enablement affects findings [OK]

Hint: Enable GuardDuty in the right region to get findings [OK]

Common Mistakes:

• Assuming IAM user creation triggers findings
• Believing CloudTrail must be manually enabled everywhere
• Thinking GuardDuty needs manual log uploads

5. You want to monitor multiple AWS accounts for threats centrally using GuardDuty. What is the best approach?

hard

A. Use GuardDuty's multi-account feature with a master account to manage findings centrally

B. Enable GuardDuty separately in each account and region, then aggregate findings manually

C. Create IAM roles in each account to share logs with a central S3 bucket for GuardDuty analysis

D. Disable GuardDuty in member accounts and rely on CloudTrail logs only

Solution

1. Step 1: Understand GuardDuty multi-account setup

   GuardDuty supports a master account that can manage and view findings from member accounts centrally.

2. Step 2: Evaluate other options

   Manual aggregation is inefficient, sharing logs via S3 is not how GuardDuty works, and disabling GuardDuty loses threat detection.

3. Final Answer:

   Use GuardDuty's multi-account feature with a master account to manage findings centrally -> Option A

4. Quick Check:

   GuardDuty multi-account = master account management [OK]

Hint: Use GuardDuty master account for multi-account threat management [OK]

Common Mistakes:

• Trying manual aggregation of findings
• Using S3 buckets for GuardDuty log sharing
• Disabling GuardDuty in member accounts