Amazon GuardDuty Deep Dive Quiz

What you'll be asked

1. Which of the following data sources is NOT natively monitored by Amazon GuardDuty?
2. An organization wants to centralize security findings from multiple AWS accounts into a single management account. Which feature should they use to achieve this?
3. You have received a GuardDuty finding indicating unauthorized access to an S3 bucket. What is the most efficient way to automate a response to block the unauthorized IP address?
4. Which GuardDuty feature should be configured if you want to prevent GuardDuty from generating findings for known, benign IP addresses within your corporate network?
5. You are investigating a compromised EC2 instance. GuardDuty detects communication with a known command-and-control server. You notice the finding is being generated repeatedly every 15 minutes. Why is this occurring despite no new activity?

Answers and explanations come after you submit.