Which AWS service provides intelligent threat detection by continuously monitoring for malicious activity and unauthorized behavior?
A.AWS WAF
WAF blocks web exploits at layer 7 — a filter, not detection.
B.Amazon GuardDuty
Correct. GuardDuty is the dedicated threat-detection service.
C.AWS CloudTrail
CloudTrail records API calls (audit), it doesn't detect threats.
D.Amazon Inspector
Inspector scans instances/images for vulnerabilities — a different function.
Why this answer
GuardDuty is AWS's managed threat-detection service — it analyzes CloudTrail events, DNS logs, and network data to detect compromised accounts, malware, and anomalous behavior.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Security Basics practice session.
Practice Security Basics