SCS-C02 Threat Detection and Incident Response Practice Question
Which AWS service can be used to detect and alert on suspicious network traffic patterns within a VPC, such as port scanning or unusual outbound traffic?
⚠ Common exam trap
Test-takers frequently confuse VPC Flow Logs (a raw data source) with a detection service, or assume AWS Network Firewall's stateful inspection includes anomaly-based alerting, when in fact GuardDuty is the only service that provides automated threat detection and alerting for network patterns like port scanning and unusual outbound traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors VPC Flow Logs, DNS logs, and CloudTrail events to identify suspicious network traffic patterns such as port scanning, unusual outbound traffic, and other malicious activities. It uses machine learning, anomaly detection, and integrated threat intelligence to generate security alerts without requiring manual rules or signatures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS WAF
Why it's wrong here
AWS WAF protects web applications from common web exploits such as SQL injection and cross-site scripting at the HTTP/S layer. It does not analyze network-level traffic patterns, inspect VPC flow data, or correlate activity across AWS services, so it cannot detect suspicious behaviors like port scanning or unusual API calls. WAF is focused on filtering ingress traffic to web apps, not on broad threat detection or alerting.
- ✓
Amazon GuardDuty
Why this is correct
Amazon GuardDuty is a managed threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence to continuously monitor VPC Flow Logs, DNS logs, and CloudTrail event logs. It identifies suspicious activity such as reconnaissance, credential compromise, or data exfiltration, and automatically generates findings that can trigger CloudWatch Events. GuardDuty is purpose-built to detect and alert on a wide range of security threats without requiring manual analysis or custom logic.
- ✗
AWS Network Firewall
Why it's wrong here
AWS Network Firewall provides stateful packet filtering, intrusion prevention, and traffic inspection for VPCs, but it is primarily a network control mechanism that enforces allow/deny rules. It does not proactively correlate events across data sources or apply global threat intelligence to detect complex attack patterns; it requires you to define specific rules for known scenarios. Detecting and alerting on broad, unknown suspicious activity would demand additional analysis tools and manual effort, making it less suitable for this use case.
- ✗
VPC Flow Logs
Why it's wrong here
VPC Flow Logs capture metadata about IP traffic, such as source and destination addresses, ports, and protocol, but they do not analyze the data or generate security alerts. Flow Logs are a raw diagnostic source that simply records network activity, leaving threat detection to other services. To identify suspicious patterns, you would need to export and process these logs with analytical tools, so they are not an automated detection and alerting solution.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.