Which of the following can help in this regard?

Your company is hosting a set of EC2 Instances in AWS. They want to have the ability to detect if any port scans occur on their AWS EC2 Instances.

Which of the following can help in this regard?
A . Use AWS inspector to consciously inspect the instances for port scans
B . Use AWS Trusted Advisor to notify of any malicious port scans
C . Use AWS Config to notify of any malicious port scans
D . Use AWS Guard Duty to monitor any malicious port scans

View Answer

Answer: D

Explanation:

The AWS blogs mention the following to support the use of AWS GuardDuty GuardDuty voraciously consumes multiple data streams, including several threat intelligence feeds, staying aware of malicious addresses, devious domains, and more importantly, learning to accurately identify malicious or unauthorized behavior in your AWS accounts. In combination with information gleaned from your VPC Flow Logs, AWS CloudTrail Event Logs, and DNS logs, th allows GuardDuty to detect many different types of dangerous and mischievous behavior including probes for known vulnerabilities, port scans and probes, and access from unusual locations. On the AWS side, it looks for suspicious AWS account activity such as unauthorized deployments, unusual CloudTrail activity, patterns of access to AWS API functions, and attempts to exceed multiple service limits. GuardDuty will also look for compromised EC2 instances talking to malicious entities or services, data exfiltration attempts, and instances that are mining cryptocurrency.

Options A, B and C are invalid because these services cannot be used to detect port scans

For more information on AWS Guard Duty, please refer to the below Link:

https://aws.amazon.com/blogs/aws/amazon-guardduty-continuous-security-monitoring-threat-detection;

(

The correct answer is: Use AWS Guard Duty to monitor any malicious port scans Submit your Feedback/Queries to our Experts