SCS-C02 Threat Detection and Incident Response Practice Question
Exhibit
Refer to the exhibit. VPC Flow Logs entry: 2 123456789010 eni-1234567890abcdef 10.0.1.5 203.0.113.50 3389 443 6 10 840 1625097600 1625097660 ACCEPT OK
A security engineer is analyzing the VPC Flow Logs entry in the exhibit. The log shows traffic from an internal IP to an external IP. Which potential security concern should the engineer investigate?
⚠ Common exam trap
The trap here is that candidates focus on the port number (3389) and assume it is about inbound RDP from the internet, but the flow direction (src internal, dst external) indicates outbound traffic, which is a different security concern related to egress filtering and potential command-and-control activity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An EC2 instance is attempting to connect to an external host on port 3389 (RDP).
The VPC Flow Logs entry shows outbound traffic from an internal IP to an external IP on destination port 3389, which is the default port for Remote Desktop Protocol (RDP). RDP outbound from an EC2 instance to an external host is a security concern because it could indicate an attacker using the instance as a pivot point to connect to an external command-and-control server or to exfiltrate data via an RDP tunnel. The log direction (src internal, dst external) and port 3389 specifically point to an outbound RDP attempt, not inbound scanning or DDoS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The instance is participating in a DDoS attack against the external IP.
Why it's wrong here
The flow log entry captures a single accepted connection, not the high-volume, multi-source packet flood characteristic of a DDoS attack. DDoS participation would manifest as thousands of simultaneous flows or massive byte counts from the instance to the target, whereas this log shows one discrete outbound session. Additionally, the source is a private EC2 IP, which would require spoofing to reflect traffic in a DDoS, and a single flow cannot sustain an amplification attack.
- ✓
An EC2 instance is attempting to connect to an external host on port 3389 (RDP).
Why this is correct
Outbound RDP from an internal EC2 instance to an external host on port 3389 is inherently suspicious because RDP is a remote administration protocol and is not a normal outbound service. This direction of traffic can indicate a compromised instance serving as a pivot, data exfiltration, or an attacker maintaining persistent control. The flow log shows source 10.0.1.5 (private) to destination 203.0.113.50 on port 3389, so the correct interpretation is that the instance is attempting an outbound RDP connection.
- ✗
An external host is scanning the internal network on port 443.
Why it's wrong here
This option misreads the flow direction: the source is the internal IP 10.0.1.5 and the destination is the external 203.0.113.50, meaning the traffic is outbound from the VPC, not an inbound scan. A port scan of the internal network would originate from an external source to multiple internal IPs or ports, generating many short-lived flows to a range of destinations. The log shows only a single flow to the external host on port 443, which is not indicative of a scanning pattern.
- ✗
The security group allows inbound RDP from 0.0.0.0/0.
Why it's wrong here
VPC Flow Logs record metadata about actual traffic (source, destination, port, protocol, action) and do not include security group rules or their configuration. To determine whether a security group allows inbound RDP from 0.0.0.0/0, you would need to inspect the security group's inbound rules via the console, CLI, or API. Furthermore, the referenced traffic is outbound (source internal, destination external), so an inbound rule on the instance's security group would not even apply to this connection.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.