A company's security engineer is developing an incident response plan to detect suspicious activity in an AWS account for VPC hosted resources. The security engineer needs to provide visibility for…

The correct answer is B. Activate Amazon GuardDuty across all AWS Regions. D. Create an Amazon Simple Notification Service (Amazon SNS) topic. Create an Amazon. Amazon GuardDuty (B) is the purpose-built threat detection service for AWS - it automatically analyzes VPC Flow Logs, DNS logs, and CloudTrail events across all enabled regions without requiring you to manually configure log ingestion, making it the most cost-effective way to…

Submitted by andres_qro· Mar 6, 2026Threat Detection and Incident Response

Question

A company's security engineer is developing an incident response plan to detect suspicious activity in an AWS account for VPC hosted resources. The security engineer needs to provide visibility for as many AWS Regions as possible. Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)

Options

ATurn on VPC Flow Logs for all VPCs in the account.
BActivate Amazon GuardDuty across all AWS Regions.
CActivate Amazon Detective across all AWS Regions.
DCreate an Amazon Simple Notification Service (Amazon SNS) topic. Create an Amazon
ECreate an AWS Lambda function. Create an Amazon EventBridge rule that invokes the Lambda

How the community answered

(43 responses)

A
7% (3)
B
74% (32)
C
16% (7)
E
2% (1)

Explanation

Amazon GuardDuty (B) is the purpose-built threat detection service for AWS - it automatically analyzes VPC Flow Logs, DNS logs, and CloudTrail events across all enabled regions without requiring you to manually configure log ingestion, making it the most cost-effective way to gain broad visibility into suspicious activity. Pairing it with an SNS topic via EventBridge (D) creates a lightweight, serverless notification pipeline that forwards GuardDuty findings to on-call teams at minimal cost.

Why the distractors are wrong:

A (VPC Flow Logs) captures raw traffic metadata but has no threat detection logic - it's expensive to store at scale and requires additional tooling to extract actionable signals.
C (Amazon Detective) is an investigation tool used to analyze incidents after GuardDuty or Security Hub has already flagged them; it doesn't detect threats and is not cost-effective as a primary detection layer.
E (Lambda + EventBridge) is essentially a more expensive, custom-code version of what a plain SNS EventBridge rule (D) already achieves - Lambda invocation costs and maintenance overhead make it the less cost-effective choice.

Memory tip: Think of it as a pipeline - GuardDuty is the sensor (detects), SNS is the alarm (notifies), and Detective is the forensics team (investigates). The exam question asks for detection + alerting, so you need the first two, not the third.

Topics

#GuardDuty#Threat Detection#Incident Response#Cost Optimization

Community Discussion

No community discussion yet for this question.

Full SCS-C02 Practice