The correct answer is Amazon EventBridge and AWS Lambda. EventBridge captures GuardDuty findings as structured events and routes them to Lambda based on rules matching a specific finding type, such as UnauthorizedAccess:EC2/SSHBruteForce. Lambda then executes custom code to modify the security group, removing the offending IP address by revoking the relevant ingress rule. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of event-driven security automation and the integration between GuardDuty, EventBridge, and Lambda. A common trap is selecting Amazon CloudWatch Events instead of EventBridge—remember that EventBridge is the modern, recommended service for event bus patterns and offers richer filtering. Another trap is choosing AWS Config, which is for compliance and resource tracking, not real-time event response. Memory tip: think "GuardDuty finds it, EventBridge binds it, Lambda blocks it."
SCS-C02 Threat Detection and Incident Response Practice Question
This SCS-C02 practice question tests your understanding of threat detection and incident response. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security engineer is configuring automated response to a specific GuardDuty finding type. The engineer wants to automatically block the offending IP address in the security group when a finding is generated. Which TWO AWS services should the engineer use together to achieve this? (Choose TWO.)
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Lambda
AWS Lambda is correct because it can execute custom code to modify security group rules, such as removing an offending IP address. Amazon EventBridge is correct because it can capture GuardDuty findings as events and trigger the Lambda function in response to a specific finding type. Together, they enable automated, event-driven remediation without manual intervention.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
AWS Lambda
Why this is correct
Lambda can run code to modify security groups based on the finding details.
Related concept
Read the scenario before looking for a memorised answer.
✗
AWS Config
Why it's wrong here
Config is used for compliance and configuration tracking, not for real-time automated response.
✗
Amazon Simple Notification Service (SNS)
Why it's wrong here
SNS can send notifications but cannot directly execute actions on security groups.
✓
Amazon EventBridge
Why this is correct
EventBridge can receive GuardDuty findings and invoke a Lambda function.
Related concept
Read the scenario before looking for a memorised answer.
✗
Amazon CloudWatch Logs
Why it's wrong here
CloudWatch Logs is for storing logs, not for triggering automated responses.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often choose SNS because it is commonly associated with GuardDuty alerts, but they overlook that SNS cannot perform API actions like modifying security groups—only Lambda or Step Functions can execute the remediation logic.
Detailed technical explanation
How to think about this question
Under the hood, EventBridge uses a rule with an event pattern that matches the GuardDuty finding type (e.g., 'UnauthorizedAccess:EC2/SSHBruteForce'). The Lambda function then uses the AWS SDK (e.g., boto3 for Python) to call 'revoke_security_group_ingress' with the specific IP and port. A subtle behavior: the Lambda function must have an IAM role with permissions for 'ec2:RevokeSecurityGroupIngress' and 'ec2:DescribeSecurityGroups', and the security group rule must match exactly (protocol, port, CIDR) to be removed.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Threat Detection and Incident Response — This question tests Threat Detection and Incident Response — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: AWS Lambda — AWS Lambda is correct because it can execute custom code to modify security group rules, such as removing an offending IP address. Amazon EventBridge is correct because it can capture GuardDuty findings as events and trigger the Lambda function in response to a specific finding type. Together, they enable automated, event-driven remediation without manual intervention.
What should I do if I get this SCS-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer is setting up automated incident response for a compromised EC2 instance. The engineer wants to isolate the instance immediately upon detection of a GuardDuty finding. Which AWS service can be used to automatically trigger a Lambda function that modifies the instance's security group?
medium
A.AWS Step Functions
B.Amazon Inspector
✓ C.Amazon CloudWatch Events
D.AWS Config
Why C: Amazon CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches specific GuardDuty finding events. When a finding is detected, the rule triggers a Lambda function that can modify the EC2 instance's security group to isolate it, for example by removing all inbound rules or replacing the group with a restrictive one. This provides the automated, event-driven response required.
Variation 2. A security engineer is configuring an automated response to a GuardDuty finding that indicates a compromised EC2 instance. The engineer wants to isolate the instance by changing its security group to a 'quarantine' group. Which AWS service is BEST suited to automate this response?
easy
A.AWS Step Functions
B.AWS Config
✓ C.Amazon EventBridge
D.AWS Systems Manager Automation
Why C: Amazon EventBridge is the best choice because it can directly receive GuardDuty findings as events and trigger an automated response, such as invoking a Lambda function or Systems Manager Automation runbook to change the EC2 instance's security group to a quarantine group. EventBridge provides native integration with GuardDuty via its default event bus, enabling real-time, event-driven automation without additional orchestration overhead.
Variation 3. A security engineer is implementing automated incident response. The engineer wants to use AWS Lambda to automatically remediate GuardDuty findings. What is the recommended pattern to trigger the Lambda function?
medium
✓ A.Configure an Amazon EventBridge rule to match GuardDuty findings and invoke the Lambda function.
B.Subscribe the Lambda function to an SNS topic that GuardDuty publishes findings to.
C.Use CloudWatch Logs subscription filter to trigger Lambda on GuardDuty log entries.
D.Have the Lambda function poll the EC2 instance metadata for threat indicators.
Why A: Amazon EventBridge is the recommended pattern because it natively integrates with AWS GuardDuty to receive all finding events in near real-time. By configuring an EventBridge rule that matches GuardDuty finding types (e.g., 'UnauthorizedAccess:EC2/SSHBruteForce'), you can directly invoke a Lambda function for automated remediation without polling or intermediate services. This pattern is serverless, event-driven, and follows AWS best practices for decoupled incident response.
Last reviewed: Jun 24, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.