SAA-C03 Q444 · Security

Question

A company needs an automated solution to detect cryptocurrency mining activity on Amazon EC2 instances. The solution must automatically isolate any identified EC2 instances for forensic analysis. Which solution will meet these requirements?

Accepted Answer

**Option A is correct because it chains three services in a fully automated, event-driven pipeline:**

1. **Detection — Amazon GuardDuty**: GuardDuty is a threat detection service that continuously monitors AWS accounts and workloads. It has **specific finding types for cryptocurrency mining**, such as `CryptoCurrency:EC2/BitcoinTool.B!DNS` and `CryptoCurrency:EC2/BitcoinTool.B`. This directly satisfies the 'detect cryptocurrency mining' requirement.

2. **Event Routing — Amazon EventBridge**: GuardDuty **automatically publishes all findings to EventBridge** (formerly CloudWatch Events) as events. You can create an EventBridge rule that filters for specific finding types (e.g., cryptocurrency-related findings). This is the **native, built-in integration** — no manual steps required.

3. **

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips