A fintech runs 200 EC2 instances in one account. GuardDuty reports UnauthorizedAccess:EC2/MaliciousIPCaller.Custom for one instance, and Security Hub shows a related high-severity finding. The instance processes payments and shares a VPC with other workloads. Which validation workflow should the responder execute to assess the scope and impact of the GuardDuty finding?
Select an answer to reveal the explanation.
Short Explanation
You want to validate the blast radius before treating one alert as the full scope. Correlation in Detective connects the finding with CloudTrail and VPC evidence so you can trace possible lateral movement.
Full Explanation
Pivoting from the GuardDuty finding to Detective is the strongest workflow because the alert indicates potential contact with a known malicious IP, while the payment instance shares a VPC with other workloads. Detective can correlate the finding with CloudTrail events and VPC flow logs, helping you map related activity and assess whether the incident extends beyond the flagged host. Isolating the payment instance and analyzing only its CloudTrail and host logs may help confirm compromise on that host, but it does not establish whether other workloads were affected. Pivoting through Security Hub to CloudTrail Insights can reveal anomalous API activity across the account, but it lacks the network evidence needed to trace lateral connections in the shared VPC. Correlating VPC flow logs and DNS logs across the VPC can expose network relationships, but without CloudTrail context it may not show which identities or API actions are associated with the activity. Exam caveat: a high-severity finding warrants prompt investigation, but a question asking to assess scope calls for correlated evidence rather than validation limited to one host or one telemetry type. In practice, review the Detective finding group and timeline, then examine CloudTrail events and VPC flow records for the flagged instance and the finding window to identify related hosts and activity.