SCS-C03 Detection Practice Question
A security engineer needs to detect when an EC2 instance is launched with an unapproved Amazon Machine Image (AMI). Which AWS service should be used to automate this detection?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config.
AWS Config is the ideal tool for continuous configuration monitoring. By creating a custom rule, you can evaluate the 'imageId' attribute of all EC2 instances upon launch. If an instance uses an AMI that is not on the approved list, Config marks it as non-compliant and can trigger automated remediation. This ensures organizational compliance for image standards and prevents the usage of hardened, unapproved, or potentially vulnerable software instances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon GuardDuty.
Why it's wrong here
GuardDuty is a threat detection service, not a configuration compliance tool. It does not monitor the configuration of resources such as which AMI was used to launch an instance. While it can detect network threats, it cannot verify if an instance adheres to internal IT image governance or policy standards.
- ✓
AWS Config.
Why this is correct
AWS Config allows for the creation of rules that evaluate the configuration of AWS resources. By checking the AMI ID of newly launched instances against an approved list, it provides real-time detection of non-compliant resources. This is the correct tool for enforcing configuration standards and auditing infrastructure against pre-defined organizational policies.
- ✗
AWS CloudTrail.
Why it's wrong here
CloudTrail records the 'RunInstances' API call, which contains the AMI ID. However, it does not provide an automated way to evaluate the configuration against a policy or baseline. You would need to build a complex external system to parse these logs and perform the comparison, whereas Config does this natively.
- ✗
Amazon Inspector.
Why it's wrong here
Amazon Inspector scans existing instances for vulnerabilities. It does not monitor the instantiation process or the specific AMI used to launch an EC2 instance. While it can identify if a running instance has vulnerable software, it is not the correct mechanism for enforcing image compliance at the moment of provisioning.
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.