Which AWS service can detect security groups that are misconfigured and allowing unrestricted access to specific ports?

AWS Trusted Advisor is the correct answer because it provides recommendations across five categories, including security. Specifically, it has checks that identify security groups with unrestricted access (0.0.0.0/0) to ports like 22 (SSH), 3389 (RDP), and 20, 21 (FTP), which are common misconfigurations. Amazon CloudWatch is a monitoring service for resources and applications, not a security configuration checker. Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, but it doesn't proactively identify misconfigured security groups in the same way Trusted Advisor does. AWS Health Dashboard provides personalized views of AWS service health and alerts, not security configuration analysis.