SCS-C02 Threat Detection and Incident Response Practice Question
A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in a VPC. The security team uses Amazon GuardDuty and has enabled Amazon Detective. Recently, GuardDuty raised a 'Recon:EC2/PortProbeUnprotectedPort' finding for one of the instances. The security engineer verified that the ALB security group only allows inbound HTTP/HTTPS from the internet. However, the finding indicates that the instance is receiving probes on port 22 (SSH). Further investigation with Detective shows that the probes originate from multiple IP addresses and are reaching the instance's private IP address. The engineer suspects that the SSH port is exposed despite the security group configuration. What is the MOST likely cause of this exposure?
⚠ Common exam trap
Test-takers frequently assume the ALB's security group fully protects the backend instances, forgetting that instances have their own security groups that are evaluated independently for direct traffic to their private IPs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The EC2 instance's security group allows inbound SSH from 0.0.0.0/0.
The GuardDuty finding 'Recon:EC2/PortProbeUnprotectedPort' indicates that an EC2 instance is receiving unsolicited probes on a port that should not be publicly accessible. Since the ALB security group only allows HTTP/HTTPS from the internet, but the probes are reaching the instance's private IP on port 22 (SSH), the most likely cause is that the instance's own security group has an inbound rule allowing SSH from 0.0.0.0/0. This bypasses the ALB's security group because the instance's security group is evaluated independently for direct traffic to the instance's private IP, and if it permits SSH from anywhere, the probes will reach the instance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The EC2 instance's security group allows inbound SSH from 0.0.0.0/0.
Why this is correct
The EC2 instance's security group explicitly permits inbound SSH on port 22 from 0.0.0.0/0. This means the instance is reachable directly from the internet on its own public or elastic IP, completely bypassing the ALB. GuardDuty detects the resulting SSH brute-force attempts from external sources, so this is the root cause despite the ALB fronting web traffic.
- ✗
VPC Flow Logs are misconfigured and are inadvertently forwarding traffic to the instance.
Why it's wrong here
VPC Flow Logs are a passive feature that captures metadata about IP traffic flowing through network interfaces. They do not have any capacity to forward, redirect, or otherwise alter traffic paths. Misconfiguring Flow Logs could affect log delivery destinations, but it cannot cause traffic to be routed to an instance, so it is not related to the GuardDuty SSH brute-force finding.
- ✗
AWS Shield Advanced is causing false positives by marking legitimate traffic as probes.
Why it's wrong here
AWS Shield Advanced is a managed DDoS protection service that continuously monitors traffic patterns and applies mitigations at the AWS edge. It does not generate GuardDuty security findings and does not identify or mark legitimate traffic as "probes." GuardDuty has its own independent threat detection pipeline, so Shield Advanced false positives cannot be the reason for an SSH brute-force finding.
- ✗
The ALB security group has an inbound rule that allows SSH from the internet.
Why it's wrong here
The engineer already verified that the ALB security group only allows inbound HTTP and HTTPS, so no SSH rule exists there to enable external access. Even if a security group on the ALB permitted SSH, an ALB operates at Layer 7 and would not forward raw SSH session traffic to backend EC2 instances; SSH to backend instances would still be governed by the instance's own security group. Therefore, the ALB security group is not the source of this issue.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.