SCS-C02 Threat Detection and Incident Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Monitor Amazon CloudWatch metrics for the VPN tunnel, such as tunnel state and data throughput.

  Why this is correct

  Amazon CloudWatch publishes VPN tunnel metrics natively, including TunnelState (UP/DOWN) and DataTransferred. A sudden, unexplained tunnel flap, prolonged DOWN state, or throughput spike during an idle period can signal a renegotiation attack, a man-in-the-middle redirecting traffic to an unauthorized peer, or a compromised customer gateway. Because these metrics are captured from the AWS side of the IPsec tunnel and are continuously recorded, they can be compared against historical baselines to detect abnormal behavior that would indicate interception or tampering.

• ✗

  Use AWS Config to check VPN configuration compliance.

  Why it's wrong here

  AWS Config is a configuration auditing service that evaluates your VPN connection's settings—such as whether static routes are configured correctly, whether encryption algorithms meet policy, or whether redundant tunnels are in place—against rules you define. However, it only examines the desired state of the resource definitions and does not inspect the actual traffic flowing through the tunnel. An intercepted VPN tunnel, where an attacker is actively capturing or modifying encrypted packets, can still be fully compliant with all your Config rules because the configuration remains unchanged. Therefore, Config cannot detect active interception or data-plane anomalies.

• ✗

  Use a third-party network monitoring tool to perform deep packet inspection.

  Why it's wrong here

  While a third-party deep packet inspection (DPI) tool can analyze packet payloads for malware or protocol anomalies, IPsec VPN traffic is encrypted end-to-end, so the tool would need to terminate the tunnel, decrypt the traffic, or be positioned inline on both ends to see plaintext. This approach is not only operationally heavy and expensive but also introduces a new point of failure and potential attack surface, making it impractical for routine monitoring of a hybrid connection. Additionally, DPI focuses on content, not on whether the tunnel itself has been hijacked or rerouted; the encrypted outer IPsec headers may not reveal interception to a passive observer. Thus, DPI is not a native, pragmatic, or reliable method for detecting tunnel compromise.

• ✗

  Enable VPC Flow Logs and analyze traffic patterns for unusual destinations.

  Why it's wrong here

  VPC Flow Logs capture metadata about IP flows within a VPC, such as source/destination IP, port, protocol, and bytes transferred, but they record traffic only after it has been decrypted by the AWS VPN endpoint or traffic that originates inside the VPC. They do not log the outer IPsec encapsulated packets traversing the on-premises-to-AWS tunnel segment, so a man-in-the-middle intercepting the tunnel before it reaches the endpoint would be entirely invisible to Flow Logs. While unusual destination patterns could indicate a compromised workload exfiltrating data, they would not reflect interception or tampering of the VPN link itself. Since Flow Logs do not provide visibility into the encrypted tunnel path, they are unsuitable for detecting this specific threat.

Go deeper

Related to this question