SCS-C02 Threat Detection and Incident Response Practice Question
A security engineer notices that an EC2 instance is sending outbound traffic to a known malicious IP address. The engineer needs to immediately block the traffic and capture a packet capture for forensic analysis. Which combination of actions should the engineer take?
⚠ Common exam trap
Watch out — candidates often confuse security groups (stateful, allow-only) with network ACLs (stateless, allow/deny) and mistakenly think a security group can block a specific IP, or they assume VPC Flow Logs provide packet-level capture when they only provide metadata.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a network ACL deny rule for the malicious IP, and enable VPC Traffic Mirroring.
A network ACL (NACL) is a stateless firewall that operates at the subnet level, allowing immediate blocking of traffic to/from a specific IP address without affecting the instance's security group rules. Enabling VPC Traffic Mirroring captures a full packet-level copy of the traffic for forensic analysis, which is superior to VPC Flow Logs (which only capture metadata). This combination provides both rapid containment and deep forensic data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Amazon GuardDuty to block the IP and enable VPC Traffic Mirroring.
Why it's wrong here
Amazon GuardDuty is a threat detection service that uses machine learning and threat intelligence to generate security findings, but it has no native capability to block or filter network traffic. Enabling VPC Traffic Mirroring only captures a copy of the instance's network packets for analysis; it does not prevent the malicious IP from communicating with the instance. Therefore, this option fails to stop the ongoing exfiltration or compromise.
- ✓
Add a network ACL deny rule for the malicious IP, and enable VPC Traffic Mirroring.
Why this is correct
Network ACLs act as a stateless firewall at the subnet level, and they explicitly support deny rules that are evaluated in numeric order before traffic reaches the EC2 instance. Adding a deny rule for the malicious IP immediately blocks both inbound and outbound traffic from that source at the subnet boundary. VPC Traffic Mirroring complements this by capturing full packet payloads, giving the security engineer the packet-level forensic data needed to investigate the incident without disrupting the traffic flow.
- ✗
Stop the EC2 instance and enable VPC Flow Logs.
Why it's wrong here
Stopping the EC2 instance does halt its network traffic, but it is a heavy-handed, disruptive action that may not be immediate and also takes the workload offline, causing availability impact. VPC Flow Logs record only metadata such as source and destination IPs, ports, protocol, and action; they do not capture packet contents, so they cannot reveal the payload of the malicious communications. This approach leaves the root cause unexamined and provides no active defense against the malicious IP.
- ✗
Modify the security group to deny outbound traffic to the IP, and enable VPC Flow Logs.
Why it's wrong here
Security groups are stateful and support only allow rules; you cannot create an explicit deny rule to block outbound traffic to a specific IP address because a security group's default behavior is to allow all outbound unless a narrower allow rule exists, but even then it cannot deny a particular destination. Additionally, VPC Flow Logs provide only flow-level metadata (IPs, ports, and accepted/rejected actions) without packet content, so they would not capture the payload for deep forensic analysis. This combination is both technically impossible for the deny action and insufficient for packet-level investigation.
Visual reference
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.