ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Amazon GuardDuty continuously ingests AWS CloudTrail, VPC Flow Logs, and DNS query logs, then applies machine-learning-based behavioral analytics and threat-intelligence feeds to identify anomalous or malicious activity such as stolen IAM credentials. Findings are generated and can be centrally aggregated across multiple accounts with GuardDuty's multi-account feature, providing near-real-time detection with no infrastructure to manage.

AWS Config evaluates resource compliance but does not use ML for behavior-based threat detection. Amazon Inspector focuses on vulnerability assessments of EC2 instances and container images, not log analytics. Querying CloudTrail logs in Athena is manual and lacks built-in ML models or continuous monitoring, making it unsuitable for real-time automated detection.