SCS-C03 Detection Practice Question
Which TWO actions should be taken to ensure that Amazon GuardDuty has the necessary data to detect unauthorized cryptocurrency mining instances?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable VPC Flow Logs in all regions.
GuardDuty relies on both VPC Flow Logs and DNS logs to identify crypto-mining patterns. Flow logs enable the detection of connections to known mining pool endpoints, while DNS logs reveal attempts to resolve these malicious domain names. Providing these inputs ensures GuardDuty's machine learning models can accurately correlate network activity with known bad actors, which is vital for maintaining the performance and integrity of the compute infrastructure against resource hijacking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable VPC Flow Logs in all regions.
Why this is correct
VPC Flow Logs provide critical network metadata that GuardDuty analyzes to detect traffic to known malicious IP addresses or unexpected ports. By enabling these logs, GuardDuty gets visibility into the network behavior of EC2 instances, which is the primary indicator of cryptocurrency mining activities occurring within an AWS environment.
- ✗
Configure CloudWatch Logs with metric filters.
Why it's wrong here
Metric filters on CloudWatch Logs are useful for application-level monitoring but do not feed directly into the GuardDuty threat detection engine. GuardDuty has its own native integration paths for network data sources, so manually filtering logs for mining keywords is inefficient and significantly less accurate than using native GuardDuty capabilities.
- ✓
Enable DNS query logging in Route 53.
Why this is correct
GuardDuty automatically consumes Route 53 Resolver Query Logs if they are configured. These logs reveal DNS queries made by instances, which are often used by mining malware to connect to command-and-control servers. Analyzing these requests is essential for detecting the communication patterns typical of unauthorized cryptocurrency mining operations.
- ✗
Install the CloudWatch agent on all instances.
Why it's wrong here
The CloudWatch agent is for collecting system metrics and application logs. It is not required for GuardDuty to perform network-level threat detection. While it provides deep visibility into host performance, it is not a direct input for GuardDuty's automated threat detection pipelines for identifying crypto-mining activity at the network level.
- ✗
Create an IAM role for GuardDuty to access S3.
Why it's wrong here
GuardDuty does not require an IAM role to access S3 buckets for network threat detection. It operates as a managed service within the AWS control plane that ingests specific, pre-defined data streams. Requiring an IAM role is a misconception regarding how GuardDuty integrates with the backend infrastructure data sources.
Visual reference
About these practice questions
This SCS-C03 question is part of Courseiva's 99-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.