GuardDuty Suppression Rules and Filters for False Positives
A company is using Amazon GuardDuty to detect threats in its AWS environment. The security team notices that GuardDuty is generating a high number of 'UnauthorizedAccess:IAMUser/MaliciousIPCaller' findings for an IAM user that is used by a legacy application. The security team has verified that the IP addresses flagged are not malicious but are legitimate IPs used by the application's third-party service. The company wants to suppress these findings without disabling GuardDuty entirely. Which solution is the MOST effective and secure?
Quick Answer
A GuardDuty suppression rule is the right tool because it lets the security team filter out a very specific, already-verified pattern of false positives, in this case a particular finding type tied to a particular IAM user's ARN, without weakening detection anywhere else in the account. Because the rule can be scoped narrowly to the exact finding type and IAM user generating it, matching findings are automatically archived going forward, while GuardDuty continues surfacing that same finding type normally for every other user or resource. This precision is the key differentiator from the alternatives: disabling the finding type entirely would silence that detection capability account-wide, meaning a genuinely malicious IP triggering the same finding type against a different user would also go undetected, trading away real coverage to fix a narrow, already-understood false positive. Modifying IAM permissions has no effect on GuardDuty's detection logic, since GuardDuty analyzes behavior and threat intelligence rather than permission grants, and VPC Flow Log filters control what network data gets logged, not what GuardDuty reports as a finding. Whenever a scenario describes a confirmed, narrowly-scoped false positive that needs to be silenced without reducing detection elsewhere, look for a suppression mechanism scoped to the exact match criteria, rather than a blunt instrument like disabling an entire finding type.
⚠ Common exam trap
The trap is choosing to disable the finding type or alter IAM permissions instead of using suppression rules — the exam tests whether you know suppression rules archive findings without losing detection capability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a GuardDuty suppression rule that automatically archives findings for that IAM user.
GuardDuty suppression rules allow you to automatically archive findings that match specific criteria (such as a particular finding type and IAM user) without disabling the detector or the finding type entirely. This is the most effective and secure way to reduce noise from known-legitimate activity while preserving GuardDuty's ability to detect other threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable the specific finding type in GuardDuty settings.
Why it's wrong here
Disabling the finding type blinds GuardDuty to genuine MaliciousIPCaller activity across the whole account, not just this user. Suppression rules scoped by criteria, or trusted IP lists, silence only the known-good IPs; disabling a finding type suits environments where that detection is never relevant.
- ✓
Create a GuardDuty suppression rule that automatically archives findings for that IAM user.
Why this is correct
A suppression rule filters findings matching specified criteria, such as the IAM user's principal ID, and automatically archives them so the security team stops receiving alerts. This satisfies the requirement to suppress the false-positive findings while keeping GuardDuty fully enabled and monitoring all other activity.
- ✗
Create a VPC flow log filter to exclude traffic from those IP addresses.
Why it's wrong here
VPC Flow Logs are a separate telemetry feature and do not feed or filter GuardDuty findings, which derive from CloudTrail, DNS and flow data internally. Suppression rules or trusted IP lists address the finding; flow log filters are for network visibility, not detection suppression.
- ✗
Modify the IAM user's permissions to restrict the IP addresses it can use.
Why it's wrong here
An IAM policy condition restricting source IPs would break the legacy application's legitimate third-party calls, not suppress the findings. GuardDuty suppression rules or trusted IP lists target the finding itself; IAM IP conditions are for access control, not detection tuning.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Amazon GuardDuty and wants to suppress low-severity findings that are known false positives. What is the recommended approach?
medium- A.Configure a CloudWatch Events rule to ignore the findings
- B.Manually delete the findings from the GuardDuty console
- C.Disable the GuardDuty detector for the affected accounts
- ✓ D.Create a GuardDuty filter to suppress the findings
Why D: GuardDuty filters allow you to automatically suppress low-severity findings that are known false positives by setting the filter action to 'ARCHIVE'. This prevents the findings from appearing in the active findings list without disabling detection or deleting data. Filters are the recommended approach because they are purpose-built for this use case and preserve the audit trail.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.