Amazon GuardDuty: Detect Unauthorized S3 Access Automatically
A company is experiencing unauthorized access attempts to an S3 bucket. Which AWS service can be used to detect and alert on such events in real time?
⚠ Common exam trap
Test-takers frequently confuse AWS CloudTrail's logging capability with real-time threat detection, but CloudTrail only records events and does not analyze them for malicious patterns, whereas GuardDuty is purpose-built for continuous threat detection and alerting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs. When it detects unauthorized access attempts to an S3 bucket, such as suspicious API calls or anomalous data access patterns, it generates real-time security findings that can be sent to Amazon CloudWatch Events for alerting and automated response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon Macie
Why it's wrong here
Amazon Macie is a fully managed data security service that uses machine learning to discover, classify, and protect sensitive data such as PII stored in S3. It does not monitor API call activity, analyze authentication attempts, or detect unauthorized access patterns. Because the question is about active intrusion attempts rather than data classification, Macie is not the correct service.
- ✗
AWS Config
Why it's wrong here
AWS Config is a governance service that records and evaluates cloud resource configurations over time, checking for compliance with rules such as whether an S3 bucket policy allows public access. It can alert you to a configuration change that broadens access, but it cannot detect specific unauthorized access attempts against that bucket. Config focuses on the state of resources, not on the real-time analysis of API event patterns or threat intelligence.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail is an audit logging service that records all API activity, including S3 request details such as principal, IP address, and event time, but it does not by itself analyze those events for malicious behavior or alert on real-time threats. To generate an alert from CloudTrail, you must write custom metric filters and create CloudWatch alarms, or feed the logs into another detection tool. Thus CloudTrail provides forensic evidence of unauthorized access but not proactive threat detection.
- ✓
Amazon GuardDuty
Why this is correct
Amazon GuardDuty is a threat detection service that continuously monitors for malicious and unauthorized behavior using integrated threat intelligence and machine learning. It ingests S3 data events from CloudTrail, as well as VPC flow logs and DNS logs, to identify anomalies like unusual access patterns, credential compromise, or suspicious source IPs. GuardDuty generates findings in near real time, making it the appropriate service for detecting unauthorized access attempts to S3.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.