SCS-C02 Security Logging and Monitoring Practice Question
Which TWO AWS services can be used to monitor network traffic for malicious activity? (Select TWO.)
⚠ Common exam trap
A common mix-up: candidates confuse AWS Shield (DDoS protection) or AWS WAF (web application firewall) with network traffic monitoring, but neither performs deep packet inspection or threat detection for general malicious network activity beyond their specific scopes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Network Firewall
AWS Network Firewall (A) is correct because it is a managed, stateful network firewall and intrusion prevention service that inspects VPC traffic (including VPC-to-VPC, egress, and ingress) and can alert on or block malicious activity using Suricata-compatible rules and managed threat signatures. Amazon GuardDuty (B) is correct because it continuously monitors network traffic and account activity—analyzing VPC Flow Logs, DNS logs, and CloudTrail events—to detect malicious or unauthorized behavior such as crypto-mining, port scanning, and communication with known malicious IPs. AWS Shield (C) is not the right answer because it is a managed DDoS protection service that mitigates volumetric and layer 3/4 attacks but does not provide general network traffic monitoring for malicious activity. AWS WAF (D) is not the right answer because it filters HTTP(S) requests at layer 7 against web exploits like SQL injection and XSS, not network traffic monitoring. Amazon Inspector (E) is not the right answer because it is a vulnerability management service that scans EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure, rather than monitoring live network traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Network Firewall
Why this is correct
AWS Network Firewall inspects inbound, outbound and east-west traffic using Suricata-compatible stateful rules, enabling signature-based detection of malicious activity across VPC subnets. It satisfies the monitoring requirement by logging alerts and flow data to CloudWatch, S3 or Kinesis Firehose, giving the visibility needed to identify threats rather than merely filtering them.
- ✓
Amazon GuardDuty
Why this is correct
GuardDuty continuously analyses CloudTrail management events, VPC Flow Logs and DNS logs using threat intelligence and machine learning to detect malicious or unauthorised activity, satisfying the requirement to monitor network traffic without deploying agents or capturing packets yourself.
- ✗
AWS Shield
Why it's wrong here
Shield provides DDoS protection at the network and transport layers, absorbing volumetric attacks, but it does not inspect traffic content or produce findings on malicious activity. It is the correct selection when the requirement is defending against distributed denial-of-service rather than monitoring for threats.
- ✗
AWS WAF
Why it's wrong here
WAF filters HTTP and HTTPS requests at layer 7 against web exploit patterns, so it cannot monitor general network traffic for malicious activity. It is the right choice when protecting a public web application from SQL injection, cross-site scripting or bot traffic via managed rule groups.
- ✗
Amazon Inspector
Why it's wrong here
Inspector scans EC2 instances, container images and Lambda functions for software vulnerabilities and unintended network exposure; it does not analyse network traffic flows. It is the correct choice when the requirement is continuous vulnerability assessment of workloads rather than detection of malicious traffic.
Visual reference
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.