A security team wants two managed services that actively surface security problems and raise findings on their own: one that detects threats such as compromised instances by analysing account and network logs, and one that scans workloads for known software vulnerabilities. Which two AWS services meet these needs? (Select TWO.)
- AAmazon GuardDuty, which continuously analyses sources such as VPC flow logs and DNS logs with threat intelligence to detect malicious activity. Correct
- BAWS CloudTrail, which keeps a log of the AWS API calls made in an account so activity can be reviewed afterwards.
- CAmazon Inspector, which automatically scans Amazon EC2 instances and container images for known software vulnerabilities and exposure. Correct
- DAWS Config, which records resource configuration over time and flags when a resource drifts from an approved setting.
- EAmazon CloudWatch, which collects metrics and logs to monitor performance and trigger alarms on chosen thresholds.
Why A is correct: GuardDuty is a managed threat-detection service that studies account and network logs and raises findings on compromised instances and reconnaissance.
Why B is wrong: CloudTrail is tempting as a security source, but it records API activity for later review and does not itself detect threats or scan for vulnerabilities.
Why C is correct: Inspector is the managed vulnerability-assessment service that scans workloads for known software flaws and unintended network reachability.
Why D is wrong: Config is plausible for governance, but it evaluates configuration compliance and history rather than detecting threats or scanning for software vulnerabilities.
Why E is wrong: CloudWatch is a tempting monitoring choice, but it focuses on operational metrics and alarms, not threat detection or vulnerability scanning.