Practice · AWS Certified Security

~/aws-scs-c03 · aws-scs-c03_d1_8778992f71e1 ▊

← AWS Certified Security - Specialty · practice sheet

aws-scs-c03_d1_8778992f71e1 domain/d1 · medium single

A security engineer notices that certain older GuardDuty findings are being excluded when GuardDuty builds attack sequence findings. What behavior of Extended Threat Detection explains this, and what should the engineer review?

A Extended Threat Detection ignores archived findings, including those auto-archived by suppression rules, so the engineer should review existing suppression rules
B Extended Threat Detection only correlates events within a 1-hour window, so the engineer should adjust the correlation window
C Extended Threat Detection excludes weak signals by design, so the engineer should manually promote them to findings
D Extended Threat Detection requires findings to be exported to S3 first, so the engineer should configure a publishing destination

Unlock this exam to join the per-question discussion and vote on questions.

next question →