ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

The option that enables Amazon GuardDuty at the organization level is correct because GuardDuty is a native AWS threat-detection service that automatically consumes CloudTrail, VPC Flow Logs, and DNS logs from all linked accounts and applies machine-learning and threat-intelligence models to identify anomalous or malicious activity. It is fully managed, so the security team does not need to build or maintain any infrastructure.

Creating a custom anomaly-detection model in Amazon SageMaker would meet the machine-learning requirement, but it requires significant data-engineering effort, model training, and ongoing infrastructure management, contradicting the low-overhead constraint. Enabling CloudTrail Insights adds some anomaly detection for API call volume but does not analyze VPC Flow Logs or DNS logs, nor does it provide comprehensive threat intelligence. AWS Config rules can detect configuration drift but do not perform machine-learning-based behavioral analytics on traffic or API patterns. Therefore, enabling Amazon GuardDuty organization-wide is the most effective and operationally efficient choice.