SCS-C02 Threat Detection and Incident Response Practice Question
A security analyst needs to detect and respond to suspicious API activity in a multi-account AWS environment. The analyst wants near real-time detection of anomalous IAM behavior and the ability to automatically invoke a remediation Lambda function when a specific finding occurs. Which combination of AWS services provides this with the least operational overhead?
⚠ Common exam trap
The trap here is assuming Security Hub or Detective generates detections, when they aggregate or investigate findings that GuardDuty and other services produce.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon GuardDuty with an AWS Organizations delegated administrator, an Amazon EventBridge rule matching the finding, and the remediation Lambda function as the rule target.
GuardDuty provides managed, near real-time threat detection using CloudTrail, VPC Flow Logs, DNS logs, and threat intelligence, and it integrates with Organizations through a delegated administrator so all accounts are covered centrally. EventBridge receives GuardDuty findings as events, and a rule can target a Lambda function directly, enabling automated remediation without building custom detection logic or per-account rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Amazon GuardDuty with an AWS Organizations delegated administrator, an Amazon EventBridge rule matching the finding, and the remediation Lambda function as the rule target.
Why this is correct
GuardDuty continuously analyzes CloudTrail management events, VPC Flow Logs, and DNS logs with threat intelligence to produce findings in near real-time. With a delegated administrator it centrally manages all accounts in the organization. EventBridge delivers findings as events, and a rule can invoke the Lambda function directly for automated remediation with minimal overhead.
- ✗
Amazon Detective with an organization-wide graph, Amazon EventBridge rules for each account, and AWS Systems Manager Automation documents to run remediation.
Why it's wrong here
Detective helps investigate and visualize findings after they occur; it does not generate the initial detection. Creating EventBridge rules per account increases overhead, and Systems Manager Automation documents are useful for remediation but do not provide the near real-time anomalous behavior detection required.
- ✗
AWS Security Hub with custom insights, Amazon CloudWatch Logs metric filters on CloudTrail, and a CloudWatch alarm that invokes the remediation Lambda function.
Why it's wrong here
Security Hub aggregates and prioritizes findings but does not itself perform anomaly detection, and custom insights are for visualization, not detection. CloudWatch metric filters on CloudTrail can match known patterns but cannot detect anomalous IAM behavior, and the setup requires manual filter maintenance.
- ✗
AWS CloudTrail with an organization trail, Amazon Athena queries scheduled by AWS Glue, and an Amazon SNS topic that invokes the remediation Lambda function.
Why it's wrong here
CloudTrail with Athena and Glue can detect suspicious activity but only on a scheduled batch basis, not near real-time, and SNS does not directly invoke Lambda on a finding; it publishes to subscribers. This approach also requires building and maintaining queries and schedules, adding operational overhead.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.