SCS-C02 Threat Detection and Incident Response Practice Question

A security engineer is investigating a potential data exfiltration incident where an attacker used a compromised EC2 instance to transfer data to an external IP. Which TWO AWS services can provide evidence of the network traffic and the API calls made from the instance?

⚠ Common exam trap

Watch out — candidates often confuse Amazon GuardDuty as a source of raw evidence (like logs) when it is actually a detection service that consumes logs from other services (VPC Flow Logs, CloudTrail, DNS logs) to generate alerts, not a storage or retrieval service for the underlying traffic or API data.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

VPC Flow Logs

VPC Flow Logs capture metadata about IP traffic going to and from network interfaces, including the source/destination IP, ports, protocol, and packet/byte counts. This provides direct evidence of data being transferred to an external IP address from the compromised EC2 instance. AWS CloudTrail records API calls made within the AWS environment, such as those executed by the EC2 instance's IAM role or the instance itself (e.g., via the AWS CLI or SDK), which can reveal actions like starting data transfers or modifying security groups to allow exfiltration.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
VPC Flow Logs
Why this is correct
VPC Flow Logs capture metadata about IP traffic to and from network interfaces, including source and destination IPs, ports, protocol, and packet/byte counts. This enables you to see large outbound transfers to an unusual external IP, which is a classic sign of data exfiltration. Note that flow logs do not contain payload contents, but they are the foundational raw network log for investigating suspected exfiltration.
✗
AWS Config
Why it's wrong here
AWS Config records resource configuration changes and evaluates them against compliance rules, such as when a security group rule is added or a bucket becomes public. It does not capture network traffic, API call activity, or data transfer events, so it cannot directly show data leaving your environment. While configuration history might reveal a change that enabled exfiltration, it is not a log of the exfiltration itself.
✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a managed threat detection service that uses machine learning and anomaly detection to generate findings, such as unusual network traffic or credential misuse. Those findings are alerts or summaries, not raw logs, so they lack the granular detail needed to trace a data exfiltration path. You would still need VPC Flow Logs or CloudTrail to validate and investigate a GuardDuty finding.
✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure. It produces a list of findings about CVEs and network reachability, but it does not log network traffic or API calls. Therefore it cannot provide evidence of active data exfiltration, only potential security weaknesses that could be exploited.
✓
AWS CloudTrail
Why this is correct
AWS CloudTrail logs every API call made by or on behalf of your resources, documenting the caller identity, source IP address, event time, and request parameters. This can reveal exfiltration via service APIs, such as an instance downloading an S3 object to an external location or invoking a Lambda function to transfer data. Unlike VPC Flow Logs, CloudTrail focuses on control-plane and data-plane API activity rather than raw network packets, but it is still a critical source for investigating API-driven exfiltration.

Go deeper

SCS-C02 Threat Detection and Incident Response Practice Question

Why each option matters

Option-by-option breakdown

Related to this question