These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
SAA-035
In a production account, you want to continuously detect misuse of credentials and suspicious communication from EC2 instances (such as malware command-and-control traffic or cryptocurrency mining). Which service can you start with without deploying agents or building a log analysis platform?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: D. Enable Amazon GuardDuty
Explanation
Amazon GuardDuty automatically ingests CloudTrail events, VPC Flow Logs, Route 53 DNS query logs, and more on the AWS side, and detects suspicious behavior using threat intelligence and machine learning. No agent deployment or log platform is required; detection begins as soon as you enable it.
Per-choice explanations
A. Record resource configuration changes with AWS Config and evaluate compliance with Config rules
Incorrect. AWS Config records the history of resource configuration changes and evaluates whether configurations comply with defined rules. That is the domain of configuration compliance, and it does not cover detecting threats such as suspicious traffic or credential misuse.
B. Enable an AWS CloudTrail trail and store the logs in an S3 bucket
Incorrect. CloudTrail only records API operations and has no capability to determine threats within those records. Detecting them requires a separate analysis mechanism. GuardDuty uses these CloudTrail logs as one of its inputs.
C. Scan EC2 instances and ECR images for vulnerabilities with Amazon Inspector
Incorrect. Amazon Inspector is a vulnerability management service that continuously scans for software vulnerabilities and unintended network reachability. It can find known CVEs but does not detect suspicious communication or credential abuse that is actually in progress.
D. Enable Amazon GuardDuty
Correct. Simply enabling it starts log ingestion and threat detection, and findings can be routed to notification and automated response through Security Hub or EventBridge.
Practical Use
Amazon GuardDuty is a managed threat detection service that detects threats that are in progress inside an AWS account. Its input data sources (CloudTrail management events, CloudTrail S3 data events, VPC Flow Logs, Route 53 Resolver DNS query logs, EKS audit logs, and others) are ingested directly on the AWS side, so you do not need to enable logs, ship them to S3, or build an analysis platform. Detections are emitted as findings with a severity (Low / Medium / High) and fire as EventBridge events, so you can connect them to SNS notifications or automated isolation with Lambda. The division of roles among similar services matters. Amazon Inspector handles vulnerability management, scanning EC2, ECR images, and Lambda functions for software vulnerabilities (CVEs) and unintended network reachability. AWS Config handles configuration compliance, recording configuration change history and evaluating rule compliance. AWS CloudTrail records API operations, and Amazon Macie discovers and classifies sensitive data in S3. GuardDuty differs in that it uses these logs as input to judge behavior such as communication with known malicious IPs and domains, API calls from unusual Regions, and cryptocurrency mining traffic from EC2. In multi-account environments, you can integrate with AWS Organizations and enable it for all member accounts at once from a delegated administrator account. On SAA-C03, requirements such as "detect suspicious activity," "compromised credentials," "malware communication," and "start immediately without agents" point to GuardDuty. Distractors include Inspector (vulnerability scanning), Config (configuration evaluation), and CloudTrail (recording only), all of which can be distinguished by the fact that they do not detect threats. There are also advanced questions about combining AWS Security Hub when you want to aggregate findings in one place.