AWS Certified Security – Specialty — Question 267

A security engineer is analyzing Amazon GuardDuty findings. The security engineer observes an Impact value for ThreatPurpose in a GuardDuty finding.
What does this value indicate?

Answer options

• A. An adversary has compromised an AWS resource so that the resource is capable of contacting its home command and control (C&C) server to receive further instructions for malicious activity.
• B. GuardDuty is detecting activity or activity patterns that are different from the established baseline for a particular AWS resource.
• C. GuardDuty is detecting activity or activity patterns that suggest that an adversary is attempting to manipulate, interrupt, or destroy the company's systems and data.
• D. GuardDuty is detecting activity or activity patterns that an adversary might use to expand its knowledge of the company's systems and internal networks.

Correct answer: C

Explanation

In Amazon GuardDuty, the 'Impact' ThreatPurpose indicates that an adversary is attempting to manipulate, interrupt, or destroy your AWS resources and data. Other ThreatPurpose values describe different behaviors, such as 'Backdoor' for command and control communication (Option A), 'Anomaly' for deviations from baselines (Option B), and 'Discovery' for reconnaissance activities (Option D).