Detection is 16% of the exam. These notes cover what GuardDuty analyzes on its own, how CloudTrail lets you prove its logs were not tampered with, and what AWS Config records and evaluates.
CloudTrail log file integrity validation uses SHA-256 for hashing and SHA-256 with RSA for signing. Every hour it delivers a signed digest file to the same bucket, in a separate folder. It detects modified or deleted logs.
Official source: docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html
Enabling validation only makes CloudTrail deliver the digest files; it does NOT validate anything by itself. To validate, use the AWS CLI (if you moved the logs, you need your own tool). Protect digests with S3 MFA Delete.
Official source: docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html
GuardDuty analyzes on its own CloudTrail management events, VPC Flow Logs and Route 53 Resolver DNS query logs. You don't need to enable any of them: it uses an independent, duplicated stream.
Official source: docs.aws.amazon.com/guardduty/latest/ug/guardduty_data-sources.html
If your instances use a DNS resolver other than AWS's (OpenDNS, Google DNS or your own), GuardDuty cannot process that data. For EC2 on Outposts it doesn't monitor DNS logs either.
Official source: docs.aws.amazon.com/guardduty/latest/ug/guardduty_data-sources.html
AWS recommends enabling GuardDuty in all Regions, even where you have no resources: an attacker can use global services (IAM, STS, CloudFront) to create resources in Regions you don't watch.
Official source: docs.aws.amazon.com/guardduty/latest/ug/guardduty_data-sources.html
AWS Config records resource configuration and its history, and evaluates compliance with rules. You can see, for example, which IAM policy a user had or which ports a security group opened on a specific date.
Official source: docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html
A conformance pack is a set of rules deployable as a single entity. Rules flag resources as noncompliant, and remediation can fix them. An aggregator centralizes data from multiple accounts and Regions.
Official source: docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html
Answer practice questions, then review your mistakes with spaced repetition.