Home › Certifications › AWS Certified Security SCS-C03 › Threat Detection and Incident Response
28 multiple-choice questions and 11 flashcards on Threat Detection and Incident Response, about 16% of the AWS Certified Security SCS-C03 bank. Every one carries a written rationale.
Threat Detection and Incident Response is one of 6 chapters in CoStudy's AWS Certified Security — Specialty (SCS-C03) bank, and it holds 28 of the bank's 178 multiple-choice questions — roughly 16% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.
Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.
7 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.
A security engineer must enable GuardDuty across 250 accounts in an Organization and ensure findings flow to a central security account, with no per-account opt-in required. The CORRECT design is:
Answer: C — Detects public and cross-account access via
GuardDuty supports a delegated administrator via Organizations. The delegated admin can auto-enable for existing and future accounts. A is the legacy invite model, not scalable. The others conflate unrelated services — Config doesn't ship GuardDuty findings, CloudTrail records API calls.
Which AWS service provides threat detection by analyzing CloudTrail, VPC Flow Logs, and DNS logs?
Answer: A — Amazon GuardDuty threat detection
GuardDuty: managed threat detection. Ingests CloudTrail (mgmt events), VPC Flow Logs, DNS logs (and S3, EKS, Lambda, RDS for additional fees). Generates findings categorized by severity. Foundation of AWS threat detection.
Which is TRUE about the relationship between GuardDuty and Security Hub?
Answer: C — Account Factory blueprint via Service Catalog
Direction matters. GuardDuty is a finding-producing detection service; Security Hub is the central aggregator (consumer) and posture-scoring service. A reverses scope. C reverses direction. D is wrong.
AWS DETECTIVE:
Answer: C — Graph analysis of GuardDuty, VPC Flow Logs, and CloudTrail data to visualize entity relationships
Detective: investigation tool. Up to 12 months of data. Pre-built behavioral graphs. Answers: 'when did unauthorized access happen,' 'what other resources were accessed.' Complements other security services. Multi-account aggregation. SCS-C02 investigation.
During root cause analysis after a confirmed compromise, investigators want to visualize how a compromised IAM role's activity connects to other resources, findings, and API calls over the incident timeline. Which SCS-C03 Domain 2 tool is explicitly named for this?
Answer: C — Amazon Detective, which visualizes relationships and behavior patterns across findings and logs
A) CloudTrail Lake supports SQL querying of API history but doesn't auto-generate the kind of relationship/behavior graph described. B) Config's relationship view is for configuration/compliance, not incident root cause. C) Correct — Detective is explicitly built for this: it visualizes resource behavior and relationships to support root cause analysis. D) Security Hub aggregates findings; the graphing/investigation capability described belongs to Detective, which Security Hub findings often feed into.
A team wants to validate its incident response plan under realistic conditions — actually degrading a dependency to observe detection and response — rather than a tabletop walkthrough. Which SCS-C03 Domain 2 service is designed for this kind of controlled experiment?
Answer: D — AWS Fault Injection Service, running a controlled experiment that induces the failure condition
A) Config detects drift after the fact; it doesn't inject failure conditions. B) Inspector performs vulnerability scanning, not exploit simulation against live workloads. C) Trusted Advisor has no such simulation capability — this is a fabricated feature. D) Correct — AWS Fault Injection Service (FIS) runs controlled chaos-engineering experiments (e.g., inducing latency, terminating instances) to validate real detection/response behavior under fault conditions.
Which GuardDuty finding family indicates an EC2 instance is communicating with a known C2 or backdoor infrastructure?
Answer: C — Landing zone with mandatory and optional
Backdoor:EC2/C&CActivity.B!DNS specifically flags DNS lookups for known C2 domains. A is reconnaissance (scanning). C is mining. D is brute-force inbound SSH. Knowing finding family semantics is heavily tested.
4 cards from the 11 in this chapter.
GuardDuty findings types?
Backdoor, Behavior, CryptoCurrency, Discovery, Execution, Exfiltration, Impact, Initial Access, Pen Test, Persistence, Policy, Privilege Escalation, Recon, Stealth, Trojan, UnauthorizedAccess.
Compromised EC2 response?
Isolate (security group restricting all), snapshot for forensics, terminate, launch clean replacement.
AWS GuardDuty?
Threat detection. Analyzes CloudTrail, VPC Flow Logs, DNS logs. ML-based.
Need to detect credential exfiltration?
GuardDuty + CloudTrail. Look for unusual API calls from unexpected locations.
These are a sample. The full Threat Detection and Incident Response chapter runs 39 items with per-chapter progress tracking, on the web and in the iOS app.
Open AWS Certified Security SCS-C03 in CoStudy →