A fintech runs about 50 accounts in an AWS Organization with Amazon GuardDuty already enabled organisation-wide from a delegated administrator. A risk review now demands deeper coverage of three specific exposures: malware on the EC2 instances and their attached EBS volumes triggered by suspicious GuardDuty findings, threats originating in the serverless functions through their network activity, and malicious access patterns against the Aurora and RDS database logins. The team wants to extend the existing detector with managed GuardDuty protections rather than building separate tooling. Which THREE GuardDuty protection plans together BEST close these gaps? Select THREE.
- AEnable GuardDuty Malware Protection for EC2 so that, when a finding indicates a compromised instance, GuardDuty performs an agentless scan of the instance and its attached Amazon EBS volumes for malware and reports the results centrally. Correct
- BEnable Amazon Inspector with deep inspection on the EC2 fleet so its continuous package vulnerability scanning substitutes for malware detection on the instances and their attached EBS volumes across the organisation.
- CEnable GuardDuty Lambda Protection so the detector monitors network activity from the organisation's AWS Lambda functions and raises findings when a function communicates with known malicious addresses or shows other suspicious behaviour. Correct
- DEnable Amazon Macie on the database export buckets so its sensitive-data classification of objects substitutes for monitoring suspicious login activity against the Aurora and RDS databases themselves across the estate.
- EEnable GuardDuty RDS Protection so the detector analyses login activity to the Aurora and Amazon RDS databases and flags suspicious or anomalous access attempts against those database engines across the accounts. Correct
Why A is correct: Malware Protection for EC2 scans an instance and its attached EBS volumes agentlessly when a suspicious finding fires, which is exactly the EC2 and EBS malware coverage the risk review demands.
Why B is wrong: Inspector finds known software vulnerabilities rather than malware on disk, so it does not deliver the EC2 and EBS malware scanning the requirement asks GuardDuty to provide.
Why C is correct: Lambda Protection analyses network activity from Lambda functions to surface threats originating in the serverless tier, which directly addresses the second stated exposure.
Why D is wrong: Macie classifies sensitive data in S3 and never inspects database login activity, so it cannot detect the malicious access patterns against Aurora and RDS that the scenario calls out.
Why E is correct: RDS Protection profiles database login activity and raises findings for suspicious access against Aurora and supported RDS engines, closing the third gap the review identified.