SCS-C02 Threat Detection and Incident Response Practice Question
A security engineer is investigating a potential compromise. An EC2 instance running Amazon Linux 2 is sending outbound traffic to a known malicious IP address. The engineer needs to capture the network traffic for analysis without alerting the attacker. Which solution meets these requirements?
⚠ Common exam trap
Test-takers frequently confuse VPC Flow Logs (which only provide metadata) with full packet capture, or assume that security groups or Network Firewall can log traffic passively, when in fact they are active security controls that could interfere with the attacker's activities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use VPC Traffic Mirroring to mirror the EC2 instance's ENI traffic to a monitoring appliance in a separate VPC.
VPC Traffic Mirroring captures all network traffic at the packet level from the EC2 instance's Elastic Network Interface (ENI) and forwards it to a monitoring appliance without any inline processing or modification of the traffic. This allows the security engineer to perform deep packet analysis while remaining completely transparent to the attacker, as the mirrored traffic is a copy and does not affect the original flow. Unlike other options, Traffic Mirroring provides full packet capture (including headers and payloads) for forensic analysis, which is essential for investigating a compromise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable VPC Flow Logs on the ENI and stream to Amazon S3 for analysis.
Why it's wrong here
VPC Flow Logs capture only network metadata—source/destination IP addresses, ports, protocol, timestamps, and byte counts—for traffic to and from the instance's ENI. Even when streamed to Amazon S3 for analysis, they do not contain the actual packet contents, so you cannot inspect payloads, reconstruct attacker commands, or extract malware. Flow logs are useful for identifying a suspicious connection but cannot provide the forensic depth needed to analyze a potential compromise.
- ✗
Attach a security group to the instance that logs all traffic to CloudWatch Logs.
Why it's wrong here
Security groups act as stateful instance-level firewalls that permit or deny traffic based on rules, but they have no native logging capability and cannot capture or record any traffic. Attaching a security group to the instance and expecting CloudWatch Logs would require additional mechanisms that don't exist; security group events are not sent to CloudWatch Logs. Therefore this option cannot provide any packet data or connection logs for the investigation.
- ✓
Use VPC Traffic Mirroring to mirror the EC2 instance's ENI traffic to a monitoring appliance in a separate VPC.
Why this is correct
VPC Traffic Mirroring copies the actual packet payloads from the EC2 instance's Elastic Network Interface and forwards them through a mirror session to a monitoring appliance—which can be hosted in a separate VPC via a Gateway Load Balancer or a Network Load Balancer. Because mirroring is out-of-band and does not insert in the data path, the original traffic is unaffected and the attacker is not alerted by any inline inspection or blocking. This provides full packet capture, enabling deep forensic analysis of the attacker's actions, commands, and any exfiltrated data with no impact on the live environment.
- ✗
Enable AWS Network Firewall on the VPC and configure a rule to log all traffic to the malicious IP.
Why it's wrong here
AWS Network Firewall is a managed, inline firewall that processes all traffic traversing the VPC before it reaches a destination, and a rule to log traffic to the malicious IP would require the firewall to be deployed in the live traffic path. This active inspection can modify or drop packets based on rules, which risks alerting the attacker to the investigation. Moreover, Network Firewall's logs contain metadata such as rules matched and connection info, not full packet payloads, so it cannot provide the deep packet analysis needed to confirm how the compromise occurred.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.