SCS-C02 Threat Detection and Incident Response Practice Question
A security engineer is investigating a potential data exfiltration from an S3 bucket. Which AWS service should be used to analyze the VPC Flow Logs for the S3 bucket's endpoint?
⚠ Common exam trap
Watch out — candidates often confuse Amazon GuardDuty's alerting capability with Amazon Detective's investigative analysis, forgetting that GuardDuty generates findings but Detective is needed for deep forensic analysis of VPC Flow Logs to understand the full scope of an incident.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Detective
Amazon Detective is the correct service because it can ingest and analyze VPC Flow Logs, including those for a VPC endpoint used to access an S3 bucket. Detective uses machine learning, statistical analysis, and graph theory to identify the root cause of suspicious network traffic patterns, such as unusual data volumes or connections to external IPs, which are indicative of data exfiltration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon Macie
Why it's wrong here
Amazon Macie is a data security service that uses machine learning to discover, classify, and protect sensitive data stored in Amazon S3. It does not consume VPC Flow Logs or network telemetry, so it cannot reveal the source/destination IPs, transferred byte counts, or connection patterns that indicate data exfiltration. Its findings are about data at rest, not data in motion, making it unsuitable for this investigation.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is an automated vulnerability management service that continuously scans EC2 instances, container images, and Lambda functions for software vulnerabilities, unintended network exposure, and security best-practice violations. Its network reachability checks only determine whether a port is accessible from the internet; they do not inspect flow log records or reconstruct historical data transfers. Therefore, Inspector cannot show what data left the network or who sent it.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a machine-learning threat detection service that ingests VPC Flow Logs, CloudTrail events, and DNS logs to generate findings such as anomaly patterns or malware IP communications. However, it is designed to alert on threats, not to provide an interactive forensic console where you can pivot through raw flow log entries by IP, port, or IAM principal and correlate multiple events over a time window. For detailed exfiltration investigation, Detective's purpose-built graph analysis is the appropriate tool.
- ✓
Amazon Detective
Why this is correct
Amazon Detective is purpose-built for security investigation: it ingests VPC Flow Logs, AWS CloudTrail, and EKS audit logs and automatically builds an interactive graph of network traffic, resource interactions, and IAM identities. You can expand a suspected instance to view all of its inbound/outbound connections, the aggregate bytes transferred per peer, and the API actions performed around each flow, which directly answers whether and how data exfiltration occurred. This interactive, multi-source correlation is exactly what the other options lack.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.