Trevor Holmes works as a cloud security engineer in a multinational company. Approximately 7 years ago, his organization migrated its workload and…

Amazon GuardDuty is a continuous security monitoring service that analyzes and processes data sources, such as AWS CloudTrail event logs, VPC Flow Logs, and DNS logs. It uses machine learning, anomaly detection, and integrated threat intelligence to identify and prioritize potential threats. GuardDuty provides detailed findings that include the affected resource, attacker IP, and geolocation, which directly aligns with the requirements described in the scenario. It is designed specifically to protect AWS accounts, workloads, and data from malicious activity and unauthorized access.

A. Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure, not a real-time threat detection service.
C. Amazon Macie is a data security service that uses machine learning to discover and protect sensitive data stored in Amazon S3.
D. Amazon Security Hub provides a comprehensive view of security alerts and findings from various AWS services, but it does not generate these findings itself.

1. Amazon Web Services. (2023). What is Amazon GuardDuty? AWS Documentation. Retrieved from https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html (See the "How Amazon GuardDuty works" section).

2. Amazon Web Services. (n.d.). Amazon GuardDuty Features. Retrieved from https://aws.amazon.com/guardduty/features/ (See "Intelligent threat detection" and "Threat intelligence" sections).

3. Amazon Web Services. (n.d.). Amazon Inspector. Retrieved from https://aws.amazon.com/inspector/ (Describes its function as vulnerability management).