A GuardDuty finding flags an EC2 instance for unusual API calls. Security needs to visualize relationships — which IPs it talked to, what the IAM role did — to scope the incident. Which service?
A.Amazon Detective
Behavior-graph investigation = Detective. Correct.
B.AWS Security Hub
Hub aggregates findings — it doesn't do deep entity analysis.
C.Amazon Inspector
Inspector scans for vulnerabilities — not incident investigation.
D.VPC Flow Logs alone
Flow logs are raw data — Detective makes them investigable.
Why this answer
Detective builds behavior graphs from CloudTrail/VPC Flow Logs/GuardDuty to investigate incidents — entity timelines, connected IPs, API call patterns. Security Hub aggregates findings; Detective investigates them.
Correct answer: A · Last reviewed 2026-11-05
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Detection & Response practice session.
Practice Detection & Response