AWS Certified Security - Specialty · study

Q_01 domain/d1 · medium single discuss →

A security team enables Amazon GuardDuty in a Region but does not enable any additional protection plans. Which attack sequence detection can GuardDuty still perform using only foundational data sources?

A Detection of cryptomining processes running inside EKS containers
B Detection of data exfiltration from an S3 bucket after the bucket becomes overly permissive
C Detection of an attack sequence starting from IAM privilege discovery activity on Amazon S3 APIs, followed by S3 control plane alterations that make a bucket policy more permissive
D Detection of malicious runtime behavior within ECS Fargate containers

Q_02 domain/d1 · medium single discuss →

A security engineer notices that certain older GuardDuty findings are being excluded when GuardDuty builds attack sequence findings. What behavior of Extended Threat Detection explains this, and what should the engineer review?

A Extended Threat Detection ignores archived findings, including those auto-archived by suppression rules, so the engineer should review existing suppression rules
B Extended Threat Detection only correlates events within a 1-hour window, so the engineer should adjust the correlation window
C Extended Threat Detection excludes weak signals by design, so the engineer should manually promote them to findings
D Extended Threat Detection requires findings to be exported to S3 first, so the engineer should configure a publishing destination

Q_03 domain/d1 · medium multi

Locked question — unlock this exam to view it.

AWS Certified Security - Specialty

Explanation

Explanation