SCS-C02 Threat Detection and Incident Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The source port used by 203.0.113.5.

  Why it's wrong here

  Source port is already present in the VPC Flow Log record, but it is ephemeral and randomly selected by the client's OS for each connection. It provides no indication of attacker identity, motive, or whether the traffic is malicious, since any TCP or UDP client uses a range of temporary source ports. Knowing the source port would not help validate whether 203.0.113.5 was attempting unauthorized access; it is simply transport-layer metadata.

• ✓

  CloudTrail logs for any `ConsoleLogin` or `AssumeRole` events from 203.0.113.5.

  Why this is correct

  CloudTrail records identity-plane events such as `ConsoleLogin` (sign-in events) and `sts:AssumeRole` with the source IP address of the caller. If the same IP 203.0.113.5 appears in these events, it directly links the network traffic to authentication or authorization activity, suggesting the IP is an active user or an attacker leveraging compromised credentials. This correlation is the strongest indicator of malicious intent because VPC Flow Logs alone cannot attribute network flows to an IAM principal, whereas CloudTrail can.

• ✗

  Network ACL changes associated with the destination subnet.

  Why it's wrong here

  Network ACL changes on the destination subnet alter which traffic is allowed into or out of the subnet, but they represent a configuration action, not evidence of an attack from a specific IP. Even if a NACL was recently modified to block 203.0.113.5, that would be a reaction to the traffic, not proof that the traffic was malicious—it could equally be a routine update or a misconfigured rule. Investigating NACL changes would not establish whether the source IP was attempting unauthorized access through a service like SSH or RDP.

• ✗

  Amazon GuardDuty findings for the destination 10.0.1.5.

  Why it's wrong here

  GuardDuty findings for destination 10.0.1.5 would describe suspicious activity involving that EC2 instance or workload, such as crypto-mining or a brute force attempt, but they may not reference 203.0.113.5 as the actor. Findings are generated from multiple data sources including DNS, NetFlow, and threat intelligence, and the absence of a finding for that specific IP does not rule out malicious behavior, nor does a finding about the destination prove this particular flow was hostile. The question specifically seeks evidence tying the source IP to malicious activity, which GuardDuty findings for the destination are too indirect to provide.

Go deeper

Related to this question