City cloud reviewers want an AWS security capability that continuously analyzes account activity and network findings to help identify threats. Which service fits that role?
Select an answer to reveal the explanation.
Short Explanation
GuardDuty is like a night watch that keeps reading the logs and waving a flag when something looks wrong. Budgets watch money, SNS delivers messages, and Macie is about sensitive data discovery—not that continuous threat radar.
Full Explanation
City cloud reviewers who need continuous analysis of account activity and network findings to help identify threats should choose Amazon GuardDuty. GuardDuty is AWS’s managed threat-detection service: it consumes CloudTrail management and data events, VPC flow logs, DNS logs, and additional optional sources, then applies threat intelligence and anomaly detection to surface findings such as unusual API calls, compromised instances, reconnaissance, or suspicious network behavior. That continuous, finding-oriented model matches the municipal need for a security radar without building a custom SIEM pipeline on day one.
Amazon Macie discovers and protects sensitive data in Amazon S3 using content inspection and classification. Framing Macie as an EC2 CPU alarm service is incorrect on two counts: Macie is not a CPU monitoring product, and CPU alarms belong with CloudWatch, not with threat-intel analysis of account activity. AWS Budgets tracks cost and usage thresholds and can alert when spend exceeds plans; it does not apply malware signature packs to VPCs and has no packet-inspection role. Amazon SNS is a pub/sub messaging service that delivers notifications to subscribers. SNS can carry GuardDuty finding alerts downstream, but it is not itself a packet-level intrusion sensor and does not analyze network or API telemetry for threats.
Exam caveat: Distinguish detection services carefully. GuardDuty = threat findings from AWS activity and network signals; Macie = sensitive data discovery in S3; Inspector = vulnerability assessment for workloads; Security Hub = aggregation and standards scoring. Cloud Practitioner questions often test whether you pick GuardDuty when the stem says “identify threats” from continuous analysis.
Operational check for the city: enable GuardDuty in every Region that hosts municipal workloads, optionally enable S3 protection and malware scanning features as appropriate, route findings to Security Hub or a ticketing SNS/EventBridge path, and define an on-call process so high-severity findings on citizen portals are triaged within agreed SLAs. Confirm that CloudTrail and VPC Flow Logs prerequisites are satisfied so GuardDuty has the telemetry it needs.