SCS-C03 Detection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  CloudWatch Contributor Insights.

  Why it's wrong here

  Contributor Insights is excellent for identifying top talkers or performance bottlenecks in logs, but it is not a security anomaly detection engine. It does not have the pre-trained machine learning models necessary to identify malicious behavior or suspicious IP addresses automatically. It requires manual query construction to provide any meaningful security insights.

• ✓

  Amazon GuardDuty.

  Why this is correct

  GuardDuty is the purpose-built threat detection service in AWS. It continuously analyzes data sources to detect anomalies like unusual IP activity or API calls from unauthorized locations. Its machine learning models are continuously updated with threat intelligence, making it highly effective at detecting modern credential abuse patterns that bypass traditional firewalls.

• ✗

  AWS CloudTrail Insights.

  Why it's wrong here

  CloudTrail Insights detects anomalies in API call volumes, not the context of the user or the IP address origin. It is designed to flag unusual spikes or drops in API activity, not specifically for detecting malicious login attempts or anomalous geolocation patterns originating from specific external IP addresses.

• ✗

  AWS Config.

  Why it's wrong here

  AWS Config is designed for resource state auditing and compliance. It monitors configuration changes, not user behavior or authentication patterns. It cannot determine if an IP address is 'suspicious' or if a user's login behavior has deviated from their baseline, as it does not perform behavioral analysis or threat intelligence correlation.