SCS-C02 Threat Detection and Incident Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  GuardDuty + Security Hub + Step Functions

  Why it's wrong here

  Security Hub is a security posture and compliance service that aggregates GuardDuty findings, but it does not provide the real-time event routing needed to trigger automated remediation. Step Functions can orchestrate complex workflows, but without an EventBridge rule, GuardDuty findings cannot directly invoke Step Functions. The correct pattern is a lightweight Lambda triggered by EventBridge; using Step Functions for a single remediation action adds operational overhead and latency.

• ✓

  GuardDuty + Amazon EventBridge + AWS Lambda

  Why this is correct

  GuardDuty continuously detects threats and generates findings that are automatically emitted as events to Amazon EventBridge. An EventBridge rule filters for the relevant GuardDuty finding types and delivers them to an AWS Lambda function, which runs the remediation logic, such as quarantining an EC2 instance or revoking IAM credentials. This serverless, event-driven design provides immediate, automated response without managing underlying infrastructure.

• ✗

  Amazon Macie + AWS Config + SNS

  Why it's wrong here

  Amazon Macie is a data classification service that discovers sensitive data in S3, not a threat detection service for compute or network activity. AWS Config tracks resource configuration changes and evaluates compliance, but it does not analyze threat intelligence or generate actionable security findings. SNS only sends notifications and has no compute capability to execute remediation, so this combination lacks both the detection engine and the automation needed.

• ✗

  CloudTrail + CloudWatch Logs + Lambda

  Why it's wrong here

  CloudTrail records AWS API activity and CloudWatch Logs centralizes log data, but neither performs intelligent threat detection like GuardDuty, which analyzes VPC flow logs, DNS logs, and other telemetry against threat intelligence. While a Lambda function can be triggered from CloudWatch Logs, this setup requires you to write custom detection rules and lacks GuardDuty's built-in findings. The absence of a purpose-built detection service makes this option insufficient for automated threat response.

Go deeper

Related to this question