CS0-003 Security Operations Practice Question
An analyst is using AWS GuardDuty and sees a finding that an EC2 instance is communicating with a known command-and-control (C2) IP address. What type of alert is this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Threat intelligence finding
GuardDuty detects threats based on known malicious IPs, so communication with a C2 IP is a security finding indicating a potential compromise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CASB alert investigation
Why it's wrong here
A Cloud Access Security Broker (CASB) primarily monitors and enforces security policies for user access to cloud applications and data, focusing on data loss prevention, compliance, and shadow IT. It operates at a higher application layer, analyzing user behavior and data flows within SaaS or IaaS applications, rather than performing deep packet inspection or network flow analysis on EC2 instance traffic to detect command and control (C2) communications.
- ✗
Vulnerability scan result
Why it's wrong here
Vulnerability scans are designed to proactively identify known security weaknesses, misconfigurations, or unpatched software within systems by comparing system configurations and installed software versions against a database of vulnerabilities. While crucial for preventative security, these scans do not detect active, real-time malicious network traffic patterns or ongoing command and control (C2) communications originating from a compromised EC2 instance, which is an active threat rather than a latent weakness.
- ✗
Cloud audit log analysis
Why it's wrong here
Cloud audit logs, such as AWS CloudTrail, record management plane activities and API calls made within a cloud environment, detailing who did what, when, and from where. While essential for forensic analysis and detecting unauthorized administrative actions, these logs do not capture the granular data plane network traffic or communication patterns between an EC2 instance and external command and control (C2) servers, which GuardDuty specifically analyzes.
- ✓
Threat intelligence finding
Why this is correct
AWS GuardDuty actively leverages continuously updated threat intelligence feeds, including lists of known malicious IP addresses, domains, and attack signatures, to identify suspicious activity. When an EC2 instance communicates with an IP address or domain identified as a known command and control (C2) server by these feeds, GuardDuty generates a finding, indicating a high probability of compromise and C2 communication.
Go deeper
Related to this question
Learn chapter
Security Metrics and KPIs
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Alert
An alert is a notification that something unusual or potentially harmful has happened in a computer system or network.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.