Which service detects a pattern like 'IAM credentials being used from an unusual geography combined with crypto-mining API calls' as a managed threat-detection finding?
A.Amazon Inspector
Inspector scans for software vulnerabilities, not behavioral threats.
B.Amazon GuardDuty
Correct. GuardDuty detects anomalous/malicious behavior from telemetry.
C.Amazon Macie
Macie discovers PII/sensitive data in S3.
D.AWS Config
Config evaluates resource configurations against rules.
Why this answer
GuardDuty is the managed threat-detection service — it continuously analyzes CloudTrail events, DNS logs, VPC Flow Logs (and more) using ML and threat intelligence to flag anomalies like credential misuse and crypto-mining. Inspector finds CVEs; Macie finds sensitive data; Config checks configuration.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Detection & Response practice session.
Practice Detection & Response