SCS-C02 Security Logging and Monitoring Practice Question
Which TWO actions should a security engineer take to ensure that Amazon GuardDuty can effectively monitor for suspicious activity in a VPC? (Choose two.)
⚠ Common exam trap
A common mix-up: candidates think enabling CloudTrail or S3 logs is sufficient for VPC monitoring, but GuardDuty specifically requires VPC Flow Logs and DNS query logs as its primary network-based data sources for detecting suspicious VPC activity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable DNS query logging and publish to CloudWatch Logs.
Amazon GuardDuty relies on DNS query logs to detect suspicious domain name resolution patterns, such as DNS tunneling or communication with known malicious domains. By enabling DNS query logging and publishing to CloudWatch Logs, GuardDuty can ingest this data as a source for its threat detection algorithms. Without DNS logs, GuardDuty cannot analyze DNS-based attack vectors within the VPC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable DNS query logging and publish to CloudWatch Logs.
Why this is correct
GuardDuty uses DNS logs for domain-based threat detection.
- ✓
Enable VPC Flow Logs and publish to CloudWatch Logs.
Why this is correct
GuardDuty uses VPC Flow Logs for network analysis.
- ✗
Enable CloudTrail data events for S3.
Why it's wrong here
GuardDuty uses CloudTrail management events, not data events.
- ✗
Enable S3 server access logs.
Why it's wrong here
GuardDuty does not use S3 access logs.
- ✗
Enable AWS Config configuration history.
Why it's wrong here
GuardDuty does not use Config history.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.