SCS-C03 Detection Practice Question
During an investigation into an EC2 instance compromise, a security analyst needs to understand the relationship between different AWS resources, such as which IAM roles were used and which IP addresses interacted with the instance. Which service should the analyst use to perform this graph-based investigation?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Detective
Amazon Detective automatically collects log data from AWS resources and uses machine learning, statistical analysis, and graph theory to build a linked data set. This allows analysts to visualize and investigate the root cause of security findings by exploring the relationships and activities between users, roles, and IP addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon CloudWatch Logs Insights
Why it's wrong here
CloudWatch Logs Insights is a powerful tool for searching and analyzing log data using a query language. However, it requires the analyst to know what to look for and does not automatically build relationships or visual graphs between different entities like Amazon Detective does.
- ✗
AWS CloudTrail
Why it's wrong here
CloudTrail provides a raw audit log of API calls made in the account. While it contains the data needed for an investigation, it is a flat list of events. It lacks the built-in visualization and automated data correlation capabilities required for complex relationship-based security investigations.
- ✓
Amazon Detective
Why this is correct
Amazon Detective simplifies the investigation process by aggregating data from CloudTrail, VPC Flow Logs, and GuardDuty. It creates a unified, interactive view that shows how resources interact over time, helping analysts quickly identify the scope and impact of a potential security incident.
- ✗
AWS Security Hub
Why it's wrong here
Security Hub is a posture management and finding aggregation service. While it can display GuardDuty findings, it does not provide the deep, graph-based investigation environment needed to trace activity across multiple sessions or resources. It usually links to Detective for deeper analysis.
About these practice questions
One of 99 original SCS-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.