SCS-C02 Threat Detection and Incident Response Practice Question
Which TWO AWS services can be used to detect unauthorized access to an S3 bucket? (Select TWO.)
⚠ Common exam trap
Candidates often confuse AWS CloudTrail (a logging service) with a detection service, forgetting that CloudTrail only records events and does not analyze or alert on unauthorized access without additional services like GuardDuty or Amazon Detective.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze S3 data events (e.g., GetObject, PutObject) logged via CloudTrail management and data events, identifying suspicious patterns such as unusual access from a known malicious IP address or an anonymous user gaining access to an S3 bucket.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS WAF
Why it's wrong here
AWS WAF is a web application firewall that filters and monitors HTTP(S) traffic destined for resources like CloudFront, Application Load Balancers, or API Gateway. It operates at the application layer to block common attack patterns such as SQL injection and cross-site scripting, but it does not inspect S3 bucket access or detect unauthorized AWS API calls. Therefore, it is not a service that identifies unauthorized access to S3 resources.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail records API activity across AWS services, capturing details like who made a request, when it was made, and what actions were taken. While CloudTrail provides an audit log that can be used for forensic analysis, it does not inherently evaluate whether actions were authorized or flag anomalous behavior. To detect unauthorized access, you would need to combine CloudTrail logs with services like GuardDuty or custom analytics, so CloudTrail alone is not a detection service.
- ✓
Amazon GuardDuty
Why this is correct
Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence to continuously monitor for malicious activity. It ingests and analyzes AWS CloudTrail event logs, VPC flow logs, and DNS logs to identify suspicious patterns, including unusual S3 access, credential compromise, or unauthorized API usage. GuardDuty generates findings that indicate potential security threats, making it a direct and effective tool for detecting unauthorized access.
- ✓
Amazon Macie
Why this is correct
Amazon Macie is a fully managed data security service that uses machine learning and pattern matching to automatically discover sensitive data such as personally identifiable information (PII) stored in Amazon S3. In addition to data classification, Macie also monitors S3 bucket activity and can detect suspicious access patterns, such as large-scale data exfiltration, unusual geolocations, or public bucket exposure. These capabilities allow Macie to alert on potential unauthorized access or data misuse.
- ✗
AWS Config
Why it's wrong here
AWS Config is a governance service that evaluates AWS resource configurations against desired baseline rules, such as checking whether an S3 bucket has public read or write access. It records configuration changes and assesses compliance over time, but it does not analyze API call sequences, user behavior, or the intent behind actions taken. As a result, AWS Config cannot detect unauthorized access attempts or anomalies in how resources are being accessed.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.