SCS-C03 Detection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Amazon GuardDuty.

  Why it's wrong here

  GuardDuty is designed to detect threats at the AWS account and network level, not at the application layer. It cannot inspect HTTP request bodies to identify SQL injection payloads. Relying on GuardDuty for web application security would result in a complete failure to detect and mitigate malicious application-level traffic patterns.

• ✓

  AWS WAF with SQL injection rule sets.

  Why this is correct

  AWS WAF specifically includes managed rule sets and custom rule capabilities to detect SQL injection patterns in HTTP headers and request bodies. By deploying WAF in front of an ALB, organizations can detect and block these attacks automatically, which is the standard industry approach for web application layer protection.

• ✗

  Amazon Inspector.

  Why it's wrong here

  Amazon Inspector is a vulnerability management service that scans EC2 instances for software vulnerabilities and unintended network exposure. It is not a web application firewall and does not inspect live HTTP traffic for malicious injection attempts. It is intended for OS-level and package-level security posture assessments, not runtime application traffic monitoring.

• ✗

  AWS CloudTrail.

  Why it's wrong here

  CloudTrail records AWS management API calls. It does not monitor or log the content of the web traffic hitting an application Load Balancer. It is completely blind to application-level attacks like SQL injection, as that traffic occurs at the protocol layer and does not interact with the AWS control plane APIs.