Amazon Web Services Security and Monitoring Questions

Designing and operating security monitoring and threat detection across Amazon Web Services environments. Topics include implementing audit logging with Amazon CloudTrail, monitoring and metrics with Amazon CloudWatch, virtual private cloud flow logs for network traffic analysis, Amazon GuardDuty for threat detection, and Amazon Security Hub for centralized findings and posture management. Candidates should be able to discuss secure log collection and retention strategies, cross account aggregation and log encryption, detection rule design and tuning, anomaly and baseline detection, integration with security information and event management systems and automated playbooks, alerting and on call processes, incident investigation and forensic evidence collection, fine grained identity and access controls for security tooling, cost and scale considerations for high volume telemetry, and approaches to continuous improvement such as threat hunting and purple team exercises. The description also covers operational practices such as run books, escalation paths, compliance evidence collection, and measuring detection and response effectiveness.