A fintech startup stores cardholder exports in S3 and runs 40 accounts under Organizations. Risk wants early warning of anomalous PII exposure, unusual API activity, and centralized queryable findings for audit. Data must stay queryable for threat hunting. Which anomalous-data detection design meets audit and hunting needs?
Select an answer to reveal the explanation.
Short Explanation
You’re building a security radar that spots odd data moves fast. Correlation shines when Macie flags PII and GuardDuty flags odd APIs in one lake. Security Hub then turns scattered signals into prioritized alerts.
Full Explanation
Amazon Macie discovers and classifies sensitive data in S3 and generates PII exposure findings, GuardDuty with S3 and IAM protection detects anomalous data access, credential misuse, and API sequences using threat intelligence and behavioral models, Amazon Security Lake centralizes those findings plus CloudTrail and VPC logs as normalized OCSF in S3 for durable Athena hunting and audit queries, and Security Hub aggregates findings into dashboards with automated insights and integrations for alerting. CloudWatch Logs Insights on flow logs alone lacks PII classification and centralized multi-account normalization, plus emailed weekly queries cannot provide real-time anomaly alerts. AWS Config conformance packs with Patch Manager assess configuration and patch compliance rather than detecting anomalous data access or PII leakage. Inspector with ECR scans finds software vulnerabilities in hosts and images, not anomalous S3 access patterns or centralized security analytics. For the exam remember Macie equals data sensitivity, GuardDuty equals behavioral threats, Lake equals OCSF hunting store, Hub equals dashboard, and in practice confirm delegated administrator aggregation and Lake subscriber queries before tuning severities.