SCS-C03 Detection Practice Question
A company wants to detect potential brute-force attacks against their public-facing web applications hosted on EC2 instances. Which TWO measures should the security team implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable AWS WAF rate-based rules to block IPs exceeding request thresholds.
Implementing a multi-layered defense strategy is essential for detecting and mitigating brute-force attacks. By combining network-level blocking through WAF and host-level monitoring via CloudWatch, organizations can ensure that anomalous patterns are detected in real-time. This proactive detection allows for automated responses, such as modifying security group rules, which significantly reduces the window of opportunity for attackers to successfully compromise sensitive workloads and accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable AWS WAF rate-based rules to block IPs exceeding request thresholds.
Why this is correct
Rate-based rules in AWS WAF automatically track the number of requests from specific IP addresses over a rolling five-minute period. When a threshold is breached, the WAF can automatically block requests from those IPs, providing an effective first line of defense against automated brute-force login attempts.
- ✗
Use AWS Shield Standard to mitigate Layer 7 application attacks.
Why it's wrong here
AWS Shield Standard is designed specifically for protecting against Layer 3 and Layer 4 Distributed Denial of Service (DDoS) attacks. It does not provide the application-level logic required to detect or block specific brute-force authentication attempts occurring at the web application layer.
- ✓
Configure CloudWatch Logs agents to stream system auth logs to CloudWatch.
Why this is correct
Streaming system authentication logs (such as /var/log/auth.log) to CloudWatch Logs allows for the creation of metric filters. These filters can trigger CloudWatch Alarms when a specific number of failed login attempts are detected within a time window, alerting security teams to brute-force activity occurring on the instance.
- ✗
Enable AWS Trusted Advisor to monitor for open security groups.
Why it's wrong here
Trusted Advisor provides recommendations for optimizing performance and cost, as well as general security best practices like identifying open security groups. While useful for overall hygiene, it is not a detective control for real-time brute-force authentication attacks against specific web application endpoints.
- ✗
Implement AWS Inspector to scan for vulnerabilities on the instances.
Why it's wrong here
AWS Inspector performs vulnerability assessments by scanning EC2 instances for software vulnerabilities and network reachability issues. It does not monitor runtime authentication logs or detect brute-force patterns, making it unsuitable for detecting active credential-based attacks occurring against your web application endpoints.
About these practice questions
This SCS-C03 question is part of Courseiva's 99-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.