A machine-learning-based threat detection service that continuously analyzes CloudTrail, VPC Flow Logs, and DNS logs to identify anomalous behavior: communication with C2 servers, cryptocurrency mining, or port scanning.
In SAP-C02 it's distinguished from Inspector (known software vulnerabilities) because GuardDuty detects suspicious behavior at runtime. Findings can be automated with EventBridge + Lambda for automatic remediation.
Amazon GuardDuty is a concept that can show up on the exam. Check the full guide to see it in context.