SCS-C03 Detection Practice Question
A security engineer needs to detect if any EC2 instances in an account have been launched with a public IP address. Which service should be used to automate this detection?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config.
AWS Config is a powerful tool for enforcing compliance with infrastructure policies. By using managed rules like 'ec2-instance-no-public-ip', the engineer can automatically flag any instance that violates the policy. This is a critical detective control for preventing unauthorized network exposure, enabling the team to remediate the violation before a security incident occurs, which is essential for maintaining a hardened, private-by-default cloud environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudTrail.
Why it's wrong here
CloudTrail captures the API call that launched the instance, but it does not provide an ongoing, real-time assessment of the instance's state. It would be difficult to query for every currently running instance that has a public IP without complex log analysis and state correlation.
- ✓
AWS Config.
Why this is correct
AWS Config provides managed rules that continuously monitor resource configurations. By evaluating instances against the 'ec2-instance-no-public-ip' rule, it can automatically detect and alert on any instance that has an assigned public IP, fulfilling the requirement for automated detection of network exposure.
- ✗
Amazon GuardDuty.
Why it's wrong here
GuardDuty monitors for malicious activity and threats, such as unusual traffic or compromised credentials. It is not designed to alert on basic configuration states, such as whether an EC2 instance has a public IP, as that is a policy compliance issue rather than a threat.
- ✗
AWS Systems Manager.
Why it's wrong here
Systems Manager is an operational tool for managing resources, patching, and running commands. While it can be used to query instance states, it does not have the built-in, continuous compliance monitoring and alerting framework that AWS Config provides for detecting unauthorized configuration states.
About these practice questions
This SCS-C03 question is part of Courseiva's 99-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.