SCS-C02 Threat Detection and Incident Response Practice Question
A security engineer is investigating a potential data exfiltration incident. The engineer suspects that an attacker is using an Amazon S3 bucket to exfiltrate data. Which AWS service can be used to analyze S3 access logs and detect anomalous patterns?
⚠ Common exam trap
Many candidates confuse AWS WAF or CloudFront as log analysis tools because they are associated with web traffic inspection, but neither provides the ability to query S3 access logs for data exfiltration patterns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Athena
Amazon Athena is the correct choice because it allows you to run SQL queries directly against Amazon S3 access logs stored in S3, enabling you to analyze large volumes of log data for anomalous patterns such as unusual data transfer volumes, repeated access from unfamiliar IP ranges, or unexpected object reads. This serverless query service is purpose-built for ad-hoc analysis of structured and semi-structured data in S3 without needing to load data into a separate database, making it ideal for incident response investigations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon CloudFront
Why it's wrong here
Amazon CloudFront is a content delivery network that accelerates the delivery of static and dynamic content via a global network of edge locations. While CloudFront can generate request logs and is capable of serving content from S3, it is not a query engine or analytical service for investigating access logs. For exfiltration analysis, you need a service that can actively query and aggregate log data, which CloudFront does not provide.
- ✓
Amazon Athena
Why this is correct
Amazon Athena is a serverless, interactive query service that allows you to analyze data directly in Amazon S3 using standard SQL without managing any infrastructure. A security engineer investigating potential data exfiltration can use Athena to run ad-hoc queries over S3 server access logs to identify unusual patterns such as repeated GET operations, large data transfers, or requests from unexpected IP addresses. Because Athena charges per query and requires no cluster setup, it is the appropriate tool for on-demand log analysis in an S3-centric investigation.
- ✗
AWS Shield
Why it's wrong here
AWS Shield is a managed DDoS protection service designed to safeguard applications from denial-of-service attacks by monitoring traffic at the perimeter and applying mitigation at the network and transport layers. It does not store, index, or query S3 access logs, nor does it provide a SQL interface for forensic analysis. Thus, Shield cannot assist in uncovering historical data exfiltration events from S3.
- ✗
AWS WAF
Why it's wrong here
AWS WAF is a web application firewall that inspects and filters HTTP(S) requests through rules defined in web ACLs, aimed at blocking threats like cross-site scripting or SQL injection in real time. Although WAF can emit logs of the web requests it inspects, its core function is active request filtering at the application layer, not post-hoc log analysis. It has no capability to investigate S3 access logs for exfiltration patterns, making it unsuitable for this forensic task.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.