SCS-C03 Detection Practice Question
An organization is running critical workloads on Amazon EKS and wants to detect suspicious activity at the container runtime level, such as unauthorized process execution or unexpected file access. Which GuardDuty feature should be enabled to achieve this level of visibility?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
GuardDuty Runtime Monitoring
GuardDuty Runtime Monitoring for EKS provides deep visibility into container-level activities. It uses a lightweight agent (GuardDuty security agent) deployed as a DaemonSet to monitor system calls and process execution. This allows GuardDuty to detect threats that occur within the container itself, which standard VPC Flow Logs or CloudTrail cannot see.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
GuardDuty EKS Audit Log Monitoring
Why it's wrong here
EKS Audit Log Monitoring analyzes the Kubernetes API server logs to detect suspicious administrative actions at the cluster level. While important, it does not provide visibility into what is happening inside the running containers, such as shell execution or file system modifications.
- ✓
GuardDuty Runtime Monitoring
Why this is correct
Runtime Monitoring uses a security agent to collect telemetry from individual containers and the underlying host. It identifies malicious behavior by monitoring system calls, providing detection for threats like crypto-mining, reverse shells, and privilege escalation that happen during the execution phase of a container.
- ✗
Amazon Inspector Container Scanning
Why it's wrong here
Amazon Inspector scans container images for known software vulnerabilities (CVEs) and package issues during build or when stored in ECR. It is a proactive vulnerability management tool rather than a reactive detection tool for runtime behavioral anomalies or active container compromises.
- ✗
VPC Traffic Mirroring for EKS Worker Nodes
Why it's wrong here
VPC Traffic Mirroring captures network packets for deep packet inspection. While it can help detect network-based threats, it does not provide insights into process execution or file system activity within the container, making it less effective for detecting runtime-level compromises compared to Runtime Monitoring.
About these practice questions
One of 99 original SCS-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.