CS0-003 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Lambda

  Why it's wrong here

  Lambda is a serverless compute service that runs code in response to events; it is not a native security monitoring service. While Lambda can be used to build custom security automations (e.g., invoking a remediation function), it does not itself ingest telemetry or detect threats. The SOC would need to pair Lambda with other services (like GuardDuty or CloudTrail) to act on findings, making it an execution engine, not a monitoring control.

• ✗

  AWS CloudTrail

  Why it's wrong here

  CloudTrail records API activity across AWS accounts, providing an audit log of who did what, when. It is primarily for governance, compliance, and operational auditing, not for real-time threat detection. While CloudTrail logs can be analyzed for suspicious patterns (e.g., unusual API calls), it lacks built-in anomaly detection or threat intelligence. GuardDuty actually uses CloudTrail events as one data source, but CloudTrail itself does not continuously monitor for malicious activity.

• ✓

  AWS GuardDuty

  Why this is correct

  GuardDuty is a managed threat detection service that continuously monitors for malicious or unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence. It ingests and analyzes VPC Flow Logs, DNS logs, and CloudTrail management events to identify threats like compromised EC2 instances, port scanning, or crypto mining. GuardDuty generates findings that a SOC can investigate, making it a core cloud-native security monitoring tool.

• ✓

  AWS Security Hub

  Why this is correct

  Security Hub aggregates security findings from multiple AWS services (GuardDuty, Inspector, Macie, etc.) and third-party tools, then applies continuous compliance checks and prioritizes alerts. It provides a centralized view of security posture, enabling the SOC to correlate and prioritize threats across accounts. While it does not generate its own threat detections from raw telemetry, its aggregation and prioritization capabilities are essential for effective monitoring. Security Hub's value is in consolidating and enriching findings, not in raw detection.

• ✗

  AWS VPC Flow Logs

  Why it's wrong here

  VPC Flow Logs capture IP traffic information (allowed/denied) at the network interface level, providing raw network metadata. They are not a security monitoring service with built-in detection; they only produce logs that must be analyzed separately. Without additional tools or analytics, flow logs do not alert on suspicious activity. GuardDuty uses flow logs as one input, but flow logs alone are not a monitoring/detection solution.

Go deeper

Related to this question