SCS-C03 Detection Practice Question
A security team needs to perform deep packet inspection (DPI) on traffic entering and leaving a specific EC2 instance to look for complex attack signatures that VPC Flow Logs cannot detect. Which AWS feature should they use to facilitate this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPC Traffic Mirroring
VPC Traffic Mirroring allows you to copy network traffic from an elastic network interface (ENI) of an EC2 instance and send it to a security appliance for inspection. This is essential for deep packet inspection (DPI), as it provides the actual packet payloads, unlike Flow Logs which only provide metadata.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC Flow Logs with custom format fields.
Why it's wrong here
VPC Flow Logs only provide metadata about network flows (source/destination IP, port, protocol, byte count). They do not capture the actual content or payload of the packets, which is required for deep packet inspection and identifying complex, application-level attack patterns or signatures.
- ✓
VPC Traffic Mirroring
Why this is correct
Traffic Mirroring effectively acts as a 'virtual tap' in the cloud. It duplicates the L2 traffic from a source ENI and encapsulates it in VXLAN to be sent to a target (like another EC2 instance or a Network Load Balancer) where specialized security software can analyze the packets.
- ✗
Amazon GuardDuty Network Monitoring
Why it's wrong here
GuardDuty analyzes VPC Flow Logs and DNS logs to detect anomalies and known malicious IPs. However, it does not perform deep packet inspection of the actual payload. It is a behavioral analysis tool rather than a full-packet capture or DPI service for custom signature matching.
- ✗
AWS Network Firewall with stateless rules.
Why it's wrong here
While AWS Network Firewall can perform DPI with stateful rules, it is an inline security service that controls traffic flow. The question asks for a feature to 'facilitate' inspection, and Traffic Mirroring is the specific feature used to 'mirror' traffic to any inspection tool of choice.
About these practice questions
One of 99 original SCS-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.