During a city security workshop, someone claims Trusted Advisor can fully replace GuardDuty for threat intelligence. How should the team separate the two purposes?
Select an answer to reveal the explanation.
Short Explanation
Trusted Advisor is the checklist buddy that says “hey, that S3 bucket looks wide open.” GuardDuty is more like the alarm that watches for shady behavior. Useful neighbors—not the same job.
Full Explanation
During a city security workshop, the correct separation is that AWS Trusted Advisor flags common misconfigurations and optimization opportunities, but it is not a full threat-detection platform and does not replace Amazon GuardDuty. Trusted Advisor inspects the account against best-practice checks in categories such as security, cost, performance, fault tolerance, and service limits—examples include open security groups, MFA on the root user, or exposed S3 policies (availability varies by Support plan). GuardDuty continuously analyzes activity and network telemetry to produce threat findings. Using Trusted Advisor alone leaves the city without behavioral threat intelligence.
The claim that Trusted Advisor fully replaces GuardDuty threat intelligence feeds is false: the products solve different problems. GuardDuty does not “only list billing discounts”; it produces security findings, while cost optimization is more associated with Trusted Advisor cost checks, Cost Explorer, and Budgets. Trusted Advisor also does not encrypt all VPC traffic by default without configuration—encryption in transit remains a design choice using TLS, VPN, Direct Connect encryption options, and service features.
Exam caveat: Map “recommendations / best-practice misconfigurations” to Trusted Advisor and “continuous threat identification from logs and findings” to GuardDuty. Do not treat a green Trusted Advisor security score as proof that no active threats exist.
Operational check: enable Trusted Advisor security checks appropriate to the city’s Support tier, assign owners to remediate failed checks (especially publicly open ports on citizen-facing fleets), and separately enable GuardDuty with a findings workflow. In workshop materials, show a side-by-side slide: Trusted Advisor = hygiene and misconfig; GuardDuty = threat detection—so staff stop treating one as a substitute for the other.