SCS-C03 Detection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Amazon CloudWatch ServiceLens

  Why it's wrong here

  CloudWatch ServiceLens is primarily focused on application performance monitoring and tracing across distributed systems. It provides visibility into service health and dependencies but is not designed to aggregate security findings or provide a centralized security posture management dashboard for security-specific alerts.

• ✓

  AWS Security Hub

  Why this is correct

  Security Hub acts as a central repository for security findings from various AWS services and partner tools. It automatically normalizes finding data into the AWS Security Finding Format (ASFF), allowing security teams to analyze and respond to threats more efficiently across multiple accounts and regions.

• ✗

  AWS Trusted Advisor

  Why it's wrong here

  Trusted Advisor provides recommendations for cost optimization, performance, and security best practices, but it does not act as a real-time finding aggregator. It lacks the deep integration with services like Macie or GuardDuty for detailed threat detection and incident management required for security operations.

• ✗

  AWS Config Aggregator

  Why it's wrong here

  AWS Config Aggregators collect configuration data and compliance status from multiple accounts and regions. While useful for compliance auditing, they do not aggregate threat-based findings from services like GuardDuty. Security Hub is the appropriate tool for aggregating security alerts and threat detections.