A security analyst must explain how Amazon GuardDuty differs from AWS CloudTrail for a city AWS environment. Which contrast is accurate?
Select an answer to reveal the explanation.
Short Explanation
CloudTrail is the signed guestbook of API calls; GuardDuty is the security guard reading signals and raising threat findings. One is primarily an audit trail, the other is primarily threat detection — they complement each other, they are not twins, and neither is a CDN or a replacement for IAM.
Full Explanation
Amazon GuardDuty emphasizes intelligent threat findings from monitored sources, while AWS CloudTrail emphasizes an audit log of AWS API activity. CloudTrail is the signed guestbook of API calls useful for governance and forensics; GuardDuty is the security guard reading signals and raising prioritized threat findings for municipal responders. One is primarily an audit trail; the other emphasizes detection of potentially malicious or unauthorized behavior across accounts and workloads. Conflating them — claiming GuardDuty replaces CloudTrail, or that CloudTrail alone is the managed threat-finding engine — loses the distinction security operations rely on. Exam caveat: mature landing zones typically enable both services and integrate findings into Security Hub or ticketing rather than choosing only one brand name from a marketing slide. Operational check: keep CloudTrail complete and protected for account activity, enable GuardDuty across accounts that host resident data, ensure findings page on-call responders with severity context, suppress only with documented rationale, and practice investigations that pivot from a GuardDuty finding into CloudTrail events for the same window to reconstruct who changed what.