AWS Certified Security – Specialty — Question 261

A company recently set up Amazon GuardDuty and is receiving a high number of findings from IP addresses within the company. A security engineer has verified that these IP addresses are trusted and allowed.
Which combination of steps should the security engineer take to configure GuardDuty so that it does not produce findings for these IP addresses? (Choose two.)

Answer options

• A. Create a plaintext configuration file that contains the trusted IP addresses.
• B. Create a JSON configuration file that contains the trusted IP addresses.
• C. Upload the configuration file directly to GuardDuty.
• D. Upload the configuration file to Amazon S3. Add a new trusted IP list to GuardDuty that points to the file.
• E. Manually copy and paste the configuration file data into the trusted IP list in GuardDuty.

Correct answer: A, D

Explanation

The correct steps involve creating a plaintext configuration file with the trusted IPs and uploading it to Amazon S3, then linking it to GuardDuty. Other options like creating a JSON file or copying data manually do not align with GuardDuty's requirements for trusted IP configurations.