SCS-C02 Security Logging and Monitoring Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Step 1: Subscribe to AWS Shield Advanced. Step 2: Add protection to AWS resources. Step 3: Integrate with AWS WAF and create a mitigation rule. Step 4: Enable health-based detection.

  Why this is correct

  This is the correct order because you must first subscribe to Shield Advanced to access its features, then specify the resources to protect before configuring WAF rules, then create the mitigation rule, and finally enable health-based detection to enhance automatic mitigation.

• ✗

  Step 1: Add protection to AWS resources. Step 2: Subscribe to AWS Shield Advanced. Step 3: Integrate with AWS WAF and create a mitigation rule. Step 4: Enable health-based detection.

  Why it's wrong here

  This sequence is invalid because Shield Advanced is an opt-in, paid AWS service that must be subscribed to before the Add protection API will accept any resource. If you attempt to protect a resource first, the console/API has no active subscription context and returns an error, meaning the remaining configuration steps cannot be performed. Subscription is the prerequisite that enables all subsequent Shield Advanced capabilities.

• ✗

  Step 1: Subscribe to AWS Shield Advanced. Step 2: Integrate with AWS WAF and create a mitigation rule. Step 3: Add protection to AWS resources. Step 4: Enable health-based detection.

  Why it's wrong here

  This ordering is flawed because the WAF mitigation rule is created to act on the specific resources you want Shield Advanced to protect, but no protections have been added yet. The rule's name, scope, and association depend on the ARN of the protected resource; without a protected resource, the rule cannot be attached or deployed. Adding protection first ensures the rule has a concrete target when it is integrated.

• ✗

  Step 1: Subscribe to AWS Shield Advanced. Step 2: Add protection to AWS resources. Step 3: Enable health-based detection. Step 4: Integrate with AWS WAF and create a mitigation rule.

  Why it's wrong here

  Health-based detection is an advanced mitigation enhancement that should only be enabled after the WAF mitigation rule exists, because it uses health-check data to decide when to activate that rule. If you enable it before the rule is created, the health checks have no mitigation policy to trigger, so the detection is inert. Thus the WAF integration step must precede the health-based detection step in the setup.

Go deeper

Related to this question