A regional bank SOC gets a GuardDuty finding for anomalous GetSecretValue and DescribeInstances calls from a production app role, followed by failed console logins in staging. Analysts must identify the originating principal, build a full event timeline, and assess cross-account scope without manually querying raw logs. Which root cause analysis method best traces the initial compromise and blast radius?

Amazon Detective performs root cause analysis by ingesting GuardDuty findings, CloudTrail management events, and VPC flow logs into a continuously updated behavior graph organized around IAM principals, roles, EC2 hosts, and IP addresses, with timelines and finding groups that surface the originating session, subsequent API calls, and cross-account activity without manual joins. Pivoting to that graph directly satisfies the need for source attribution, timeline reconstruction, and scope assessment in one view. Reviewing CloudTrail Insights helps by anomaly detection because it flags unusual API volume and error rates but does not link entities or show lateral movement across accounts. Running Athena reconstruction helps by SQL forensics because it can list API history from centralized logs but requires manual schema handling, iterative queries, and analyst effort to correlate principals. Aggregating in Security Hub with automation helps by centralization and response because it normalizes findings and can trigger containment, but it does not provide causal graphing or timeline analysis. Exam caveat: Detective is investigative and retrospective, requiring enablement in each Region and account with sufficient log retention, and it does not block or remediate. Practical check: confirm Detective is enabled with Organization behavior graph coverage, then open the Finding Group profile to validate first-seen principal, invoked APIs, and linked entities before scoping containment.