Courseiva
Threat Detection and Incident ResponseeasyMultiple SelectObjective-mapped

SCS-C02 Amazon GuardDuty Practice Question

Which TWO AWS services can be used to detect anomalous API activity in an AWS account? (Choose two.)

⚠ Common exam trap

The trap is that candidates may select VPC Flow Logs or AWS Config because they are associated with security monitoring, but they do not directly detect anomalous API activity. Additionally, some candidates might think only GuardDuty is a threat detection service and overlook that CloudTrail Insights also provides anomaly detection.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Amazon GuardDuty

Amazon GuardDuty is a threat detection service that uses machine learning and anomaly detection to identify suspicious API activity. AWS CloudTrail, with the CloudTrail Insights feature, provides continuous monitoring and detection of anomalous API activity by analyzing management events and generating insights. Additionally, CloudTrail logs can be used with Amazon CloudWatch to set up metric filters and alarms for detecting unusual patterns. Therefore, both GuardDuty and CloudTrail are valid services for detecting anomalous API activity.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Amazon GuardDuty

    Why this is correct

    GuardDuty detects anomalous API activity using ML.

  • AWS CloudTrail

    Why this is correct

    CloudTrail logs can be analyzed for anomalous patterns.

  • VPC Flow Logs

    Why it's wrong here

    VPC Flow Logs capture network traffic, not API calls.

  • AWS Config

    Why it's wrong here

    AWS Config tracks configuration changes.

  • Amazon Inspector

    Why it's wrong here

    Amazon Inspector scans for vulnerabilities.

About these practice questions

This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.