Exam AWS DevOps Engineer Professional topic 1 question 142 discussion

"Create an AWS CloudFormation stack set that accepts the GuardDuty invitation" Really? Its A

A. Correct. The admin account handles event for all accounts. B. Stack sets? Not necessary. C. Doesn't involve GuardDuty. D. SCPs can't enable Flow logs.

Option B is the best solution because it meets all of the requirements stated in the question and is in accordance with AWS best practices. It allows the company to detect potentially compromised EC2 instances, suspicious network activity, and unusual API activity in its existing AWS accounts and in any AWS accounts that the company creates in the future using Amazon GuardDuty. It also provides a solution for automatically adding future AWS accounts to GuardDuty by configuring GuardDuty to add newly created AWS accounts by invitation and to send invitations to the existing AWS accounts. Option A is not the best solution because it does not provide a solution for automatically adding future AWS accounts to GuardDuty. It only involves configuring an AWS account as the GuardDuty administrator account and adding the company’s existing AWS accounts to GuardDuty as members.

has to be C "to detect potentially compromised EC2 instances, suspicious network activity, and unusual API activity"

According ChatGPT, option A deals with both existing and future AWS accounts. The solution involves configuring an AWS account as the Amazon GuardDuty administrator account in the organization's management account, and adding existing AWS accounts to GuardDuty as members. For future AWS accounts, the solution leverages GuardDuty's ability to automatically add new accounts that are created within the organization by enabling "Add new accounts by invitation" feature. This ensures that any new AWS accounts that are created in the future will automatically be added to the GuardDuty member accounts list and monitored for suspicious activity.

repost: Cannot be A, it does not deal with future accounts at all

Option A is incorrect because while it correctly identifies Amazon GuardDuty as a solution to detect threats, it does not provide a way to deploy the necessary resources to all AWS accounts in the organization automatically.

Cannot be A, it does not deal with future accounts at all

B is the answer

Answer is A. You don't need to accept a GuardDuty invitation if the member GuardDuty accounts are within the same AWS Org.

I'll go with A https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_organizations.html

A sure

A seems correct