SCS-C03 Detection Practice Question
Exhibit
{
"schemaVersion": "2.0",
"accountId": "123456789012",
"region": "us-east-1",
"partition": "aws",
"id": "a1b2c3d4e5f6g7h8i9j0",
"type": "Execution:EC2/MalwareDetected",
"service": {
"serviceName": "guardduty",
"detectorId": "d1e2f3g4h5i6",
"action": {
"scanEc2InstanceWithFindingsAction": {
"ec2InstanceArn": "arn:aws:ec2:us-east-1:123456789012:instance/i-0123456789abcdef0",
"scanId": "s-0987654321fedcba0"
}
}
}
}Refer to the exhibit. This GuardDuty finding indicates that malware was detected on an EC2 instance. What is the process GuardDuty used to perform this scan without installing an agent on the instance?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It takes a snapshot of the EBS volume, restores it to a service-owned account, and scans the volume there.
GuardDuty Malware Protection performs agentless scans of EBS volumes. When a suspicious finding is triggered (like a command-and-control communication), GuardDuty creates a snapshot of the EBS volumes, shares them with a service-linked account, and then attaches them to a scanning instance to perform a malware analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It uses the AWS Systems Manager (SSM) Agent to run a remote anti-virus script on the instance.
Why it's wrong here
GuardDuty Malware Protection does not use the SSM Agent or run any scripts inside the guest operating system. This ensures that the scan does not consume instance resources (CPU/RAM) and cannot be easily detected or tampered with by malware running on the instance.
- ✓
It takes a snapshot of the EBS volume, restores it to a service-owned account, and scans the volume there.
Why this is correct
GuardDuty automates the snapshotting and volume creation process in an isolated environment. By scanning a copy of the volume, GuardDuty avoids performance impacts on the production workload and maintains the integrity of the original data while searching for malicious file signatures and patterns.
- ✗
It performs deep packet inspection (DPI) on the VPC traffic to identify malware being downloaded.
Why it's wrong here
While GuardDuty monitors network traffic via VPC Flow Logs, this specific 'MalwareDetected' finding refers to the Malware Protection feature, which scans the file system. Network monitoring detects the 'behavior' of downloading malware, but the scan itself is performed on the disk storage.
- ✗
It uses the GuardDuty Security Agent to perform a memory dump and analyze it for malicious strings.
Why it's wrong here
GuardDuty Malware Protection currently focuses on EBS volume scanning rather than memory analysis. While Runtime Monitoring uses an agent for process activity, the Malware Protection feature is specifically designed to be agentless and operates at the storage level by analyzing disk snapshots.
About these practice questions
One of 99 original SCS-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.