A security analyst wants to be alerted when Amazon GuardDuty detects a potential cryptocurrency mining activity from an EC2 instance in their VPC. They have GuardDuty enabled and sending findings to CloudWatch Events. What is the most direct way to set up this alert?

Set up an AWS Config rule to check for instances with high CPU usage.

Create a CloudWatch alarm on the VPC Flow Logs metric for outbound traffic to known mining pools.

Use CloudTrail to monitor for API calls that start mining software.

Create a CloudWatch Events rule that matches GuardDuty findings with the type 'CryptoCurrency' and targets an SNS topic.

A security engineer wants to receive notifications when Amazon GuardDuty generates a new finding. Which AWS service can be used to trigger a notification based on GuardDuty findings?

Amazon CloudWatch Events (or EventBridge)

A security analyst wants to be alerted when the number of rejected connections in a VPC exceeds a threshold. What must be created in CloudWatch to monitor the metric and trigger an action?

A CloudWatch Logs metric filter

A security analyst is examining a VPC Flow Log record and sees the following fields: srcaddr, dstaddr, srcport, dstport, protocol, action. What does the 'action' field indicate in a flow log record?

Whether the flow log itself is enabled or disabled

The type of protocol used (TCP, UDP, ICMP)

The direction of traffic (ingress or egress)

Whether the traffic was accepted or rejected by security groups and network ACLs

AWSCertified Advanced Networking - Specialty

Domain 4Objective 2

Task 4.2: Validate and Audit Security by Using Network Monitoring and Logging Services ANS-C01 Practice Questions (Page 2)

Part of the Content Domain 4: Network Security, Compliance, and Governance domain, which accounts for 24% of the ANS-C01 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~17–28 in this domain), expect 6–9 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

10concepts

24%of the exam

10 Concepts in This Objective

Network Monitoring and Logging Services Overview
VPC Flow Logs Configuration and Analysis
CloudWatch Logs for Network Security
CloudTrail for Network API Auditing
AWS Config for Network Compliance
GuardDuty for Threat Detection
Log Aggregation and Centralization
Security Auditing with Athena and QuickSight
Alarming and Notification for Security Events
Compliance Validation and Reporting

Questions 6–10

6application · medium
A security analyst wants to be alerted when Amazon GuardDuty detects a potential cryptocurrency mining activity from an EC2 instance in their VPC. They have GuardDuty enabled and sending findings to CloudWatch Events. What is the most direct way to set up this alert?
Select an answer first
7foundation · easy
A security engineer wants to receive notifications when Amazon GuardDuty generates a new finding. Which AWS service can be used to trigger a notification based on GuardDuty findings?
Select an answer first
8foundation · easy
A security analyst wants to be alerted when the number of rejected connections in a VPC exceeds a threshold. What must be created in CloudWatch to monitor the metric and trigger an action?
Select an answer first
9foundation · easy
An organization must validate that its network monitoring and logging practices meet regulatory requirements. Which AWS service can be used to evaluate the configuration of network resources against a set of compliance rules and provide a compliance score?
Select an answer first
10foundation · easy
A security analyst is examining a VPC Flow Log record and sees the following fields: srcaddr, dstaddr, srcport, dstport, protocol, action. What does the 'action' field indicate in a flow log record?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ANS-C01

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “ANS-C01” is a trademark of its owner, used for identification only.