SCS-C03 Detection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable VPC Flow Logs analysis within GuardDuty.

  Why it's wrong here

  GuardDuty VPC Flow Logs analysis focuses on network traffic between instances, not data-level interactions with S3. Since S3 is a regional, public-facing service, VPC flow logs cannot capture the specific API calls or object-level access patterns required to identify data exfiltration attempts happening at the storage layer.

• ✓

  Activate S3 Protection in Amazon GuardDuty.

  Why this is correct

  GuardDuty S3 Protection specifically monitors CloudTrail data events to detect suspicious behavior like unusual data access patterns or access from malicious IP addresses. It helps detect compromised credentials or insider threats attempting to exfiltrate data from buckets, making it the most effective tool for this specific security requirement.

• ✗

  Configure AWS CloudTrail Insights for the S3 management events.

  Why it's wrong here

  CloudTrail Insights detects anomalies in management events, such as creating or deleting buckets. It does not monitor the data plane, meaning it cannot detect the actual object-level 'GetObject' calls required to monitor for exfiltration. It is designed for operational monitoring rather than identifying granular data access anomaly patterns.

• ✗

  Deploy Macie to monitor S3 bucket access logs.

  Why it's wrong here

  Amazon Macie is primarily designed for data discovery and classification to identify PII. While it can identify publicly accessible buckets, it is not an anomaly detection engine meant for monitoring real-time access patterns or identifying potential exfiltration activities by users; it is a sensitive data security and compliance tool.