ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Enabling Amazon GuardDuty provides a managed intrusion‐detection capability that needs no additional appliances or sensors. GuardDuty continuously analyzes VPC Flow Logs, AWS CloudTrail management and DNS query logs, applying machine-learning models and AWS threat-intelligence feeds to detect events like port scans, brute-force attempts, and cryptocurrency mining. It automatically generates actionable findings that can be sent to CloudWatch Events for alerting.

Simply enabling VPC Flow Logs and creating CloudWatch metric filters offers raw network metadata but leaves the burden of developing, updating, and tuning detection logic to the customer, so threats may be missed. AWS Network Firewall focuses on stateful inspection and intrusion prevention; it still requires provisioning and managing firewall endpoints in each Availability Zone, increasing operational overhead. Using VPC Traffic Mirroring with self-managed Suricata instances achieves deep packet inspection but demands you deploy, scale, and maintain the IDS infrastructure yourself. GuardDuty alone fulfills the security and operational requirements most effectively.