Being a cloud security administrator, Jonathan is responsible for securing the large-scale cloud infrastructure of his organization SpectrumIT…

Amazon GuardDuty is a managed threat detection service that continuously monitors for malicious or unauthorized behavior to protect AWS accounts and workloads. It uses machine learning, anomaly detection, and integrated threat intelligence to identify and prioritize potential threats. GuardDuty analyzes events from AWS CloudTrail, VPC Flow Logs, and DNS logs. This service directly addresses the need to receive alerts for misconfigurations and network intrusions, as described in the scenario.

A. Amazon SQS (Simple Queue Service) is a message queuing service used for decoupling and scaling microservices, not for threat detection.
B. Amazon VPC (Virtual Private Cloud) is a networking service that provides an isolated cloud environment, but it does not perform threat detection itself.
C. Amazon SNS (Simple Notification Service) is a messaging service for sending notifications. It can deliver alerts from GuardDuty but does not generate them.

1. Amazon Web Services. (n.d.). What is Amazon GuardDuty?. AWS Documentation. Retrieved from https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html. (Official documentation stating GuardDuty is a "threat detection service that continuously monitors your AWS accounts and workloads for malicious activity").

2. Amazon Web Services. (n.d.). Amazon GuardDuty Features. Retrieved from https://aws.amazon.com/guardduty/features/. (This page details how GuardDuty detects threats like intrusions and account compromise).