SCS-C02 Threat Detection and Incident Response Practice Question
A company uses Amazon Detective to investigate security findings. The security team is analyzing a GuardDuty finding of type 'Backdoor:EC2/C&CActivity.B!DNS' for an EC2 instance. The team wants to use Detective to understand the full scope of the incident, including which other resources the instance communicated with and any IAM roles used. However, when the team opens the finding in Detective, they see no network activity data for the instance. The instance is in a VPC with VPC Flow Logs enabled, and Flow Logs are being published to CloudWatch Logs. What should the team do to enable Detective to display the network activity?
⚠ Common exam trap
Many candidates assume simply enabling VPC Flow Logs and publishing to CloudWatch Logs is sufficient, but they overlook the requirement that the logs must be in the same AWS account and Region as the Detective behavior graph for ingestion to occur.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure that VPC Flow Logs are enabled for the VPC and are being published to Amazon CloudWatch Logs in the same account and Region as Detective.
Amazon Detective ingests VPC Flow Logs from CloudWatch Logs to generate network activity visualizations for EC2 instances. Even though VPC Flow Logs are enabled and published to CloudWatch Logs, Detective requires that the logs are in the same AWS account and Region as the Detective behavior graph. If the logs are in a different account or Region, Detective cannot access them, resulting in no network activity data being displayed for the instance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Re-enable the GuardDuty finding in Amazon Detective.
Why it's wrong here
Re-enabling a GuardDuty finding in Amazon Detective is not the issue here: the finding is already present in Detective, and the missing piece is the supporting network activity data. Detective automatically ingests GuardDuty findings as a source of contextual clues, but it cannot retrofit network paths without the underlying VPC Flow Logs. Simply toggling the finding would not cause Detective to backfill or begin receiving flow log data, so it would leave the network information blank.
- ✗
Enable GuardDuty EKS Audit Logs monitoring.
Why it's wrong here
Enabling GuardDuty EKS Audit Logs monitoring addresses Kubernetes control-plane activity for Amazon EKS clusters, not VPC network traffic for EC2 instances. EKS audit logs capture API calls to the Kubernetes API server, which is a different telemetry source than VPC Flow Logs. Since the missing data is about network connections between resources, this option would not populate the network activity section in Detective and is therefore not the correct remediation.
- ✓
Ensure that VPC Flow Logs are enabled for the VPC and are being published to Amazon CloudWatch Logs in the same account and Region as Detective.
Why this is correct
Amazon Detective relies on VPC Flow Logs to populate the network activity details on a finding, such as source/destination IPs, ports, and protocol. For those flow logs to be ingested, they must be enabled for the relevant VPC and published to Amazon CloudWatch Logs in the same AWS account and Region as the Detective graph. Without this configuration, Detective can still show the GuardDuty finding and some API activity, but the network path section will be empty—so enabling VPC Flow Logs is the correct fix.
- ✗
Install the Amazon Detective agent on the EC2 instance.
Why it's wrong here
Amazon Detective is an agentless service; it does not require or support installing any agent on an EC2 instance to gather telemetry. Instead, Detective ingests data from existing sources such as AWS CloudTrail, VPC Flow Logs, GuardDuty findings, and EKS audit logs. Installing an agent would not help because there is no Detective agent to install, and even a generic network agent would not feed into Detective’s graph. Therefore, this option cannot enable the missing network activity data.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.