SCS-C02 Threat Detection and Incident Response Practice Question

A security engineer is configuring an AWS environment to detect and respond to potential security threats. Which AWS service can be used to automate the remediation of unwanted access to Amazon S3 buckets by invoking AWS Lambda functions?

⚠ Common exam trap

Many exam-takers confuse AWS Config's ability to auto-remediate noncompliant resources (using AWS Config rules and Lambda) with GuardDuty's threat-specific detection and response, but AWS Config does not detect security threats like unauthorized access—it only enforces configuration rules.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Amazon GuardDuty

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It can integrate with AWS Lambda functions via CloudWatch Events to automate remediation actions, such as blocking unwanted access to S3 buckets by updating bucket policies or removing public access. This makes GuardDuty the correct choice for detecting and automatically responding to security threats against S3 resources.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
AWS Config
Why it's wrong here
AWS Config is a configuration auditing and compliance service that records resource configuration changes and evaluates them against desired policies via managed or custom rules. It does not analyze access patterns or leverage threat intelligence to detect anomalies, and while it can trigger Lambda remediations, those are limited to noncompliant configurations, not security findings. Therefore, it cannot identify unusual S3 access behavior such as a compromised credential downloading objects at odd hours.
✓
Amazon GuardDuty
Why this is correct
Amazon GuardDuty is a threat detection service that continuously analyzes AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs using machine learning and integrated threat intelligence. It specifically detects suspicious S3 access patterns, such as unusual geographical locations, high-volume downloads, or bucket enumeration, and raises findings that can be sent to Amazon EventBridge. This enables automated remediation, for example a Lambda function that revokes IAM policies or applies a bucket policy, making it the correct choice for detecting and automating response to access threats.
✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management service that performs continuous scans of EC2 instances and container images for software vulnerabilities (CVEs) and unintended network exposure through network reachability checks. It does not monitor S3 data plane activity or analyze behavioral patterns like login timing or data exfiltration, and it lacks the threat intelligence and anomaly detection capabilities needed to identify compromised access. Consequently, Inspector would not detect abnormal S3 bucket access events, as its focus is on host and application weaknesses rather than user behavior.
✗
AWS WAF
Why it's wrong here
AWS WAF is a web application firewall that protects web resources such as Application Load Balancers, CloudFront distributions, and API Gateway by filtering and monitoring HTTP(S) requests based on rules that block common web exploits like SQL injection and cross-site scripting. It operates at the application delivery edge and has no visibility into S3 bucket access or AWS API-level actions, nor does it analyze CloudTrail logs for authentication anomalies. Thus, WAF is not designed to detect or react to suspicious S3 access patterns, making it incorrect for this scenario.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Threat Detection and Incident Response Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question