Scoping events and root cause analysis (Detective): SCS-C03 study notes and practice questions
What to know about Scoping events and root cause analysis (Detective) for the SCS-C03 exam, from the Incident Response domain (14% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.
These questions ask how far an incident reached and how the attacker got in. You build a timeline from identity, time and address, using the tool that fits the question: Detective for a visual, graph-based view and SQL or Security Lake for precise, custom questions over full history. The root cause is usually a control that was missing or changed, and configuration history shows when that happened.
Building the timeline
CloudTrail records who acted. The userIdentity element shows the principal, the access key ID and, for role sessions, the role that issued the session and whether MFA was used. Follow a temporary session back to its source.
AWS Config records what the configuration looked like. A resource’s configuration timeline shows when a bucket became public or a security group opened a port, which answers root cause questions.
IAM Access Analyzer shows which resources are shared outside the organization, which may explain how data was reached.
VPC Flow Logs and DNS logs show which addresses and names were contacted and when.
Amazon Detective
Detective builds behavior graphs from CloudTrail logs, VPC Flow Logs and GuardDuty findings, and it provides profiles for IP addresses, IAM roles and users, showing how activity compares with normal behavior.
It is for investigation, not detection. GuardDuty detects; Detective helps you understand a finding.
Enable it with a delegated administrator so the organization’s accounts are covered with one setup, and invite accounts to the graph.
Detective does not replace the raw logs. Keep the raw logs in S3, because Detective’s data is not your archive.
How to choose
Scenario wording
Pick
Visual graph of an IAM role’s activity and unusual IP behavior
Amazon Detective
Every API call made with one access key over the last 30 days
Athena query on the trail’s history in S3
Which configuration change exposed a bucket, and when
AWS Config resource timeline
Which resources outside the organization can be reached
IAM Access Analyzer external access findings
Where a stolen credential was used across Regions
CloudTrail query filtered by access key ID across Regions
Scope across hundreds of accounts quickly
Detective with a delegated administrator, or Security Lake queries
Common traps
Expecting Detective to find threats. GuardDuty detects; Detective investigates.
Enabling Detective account by account when a delegated administrator covers the organization.
Querying only the management account’s trail when member accounts run their own trails.
Changing or deleting resources before scoping. Contain first, but capture evidence before any cleanup.
Relying on CloudTrail event history, which holds only recent management events. Use a trail stored in S3 for longer investigations.
Using Config to answer who made a change. Config shows the state; CloudTrail shows the actor.
A hospital's GuardDuty finding reports that an IAM user's access keys were used from an unusual country. The security team must find out what that identity did in the past month across 20 member accounts, which API calls it made, which resources it touched, and whether those calls connected it to other identities.
The analysts are not SQL specialists and must answer the question within one shift. They want a visual view of the relationships, and the data must be kept for at least 90 days so the team can look further back if needed.
Which solution should the team use?
Choose one answer.
AA. Query the CloudTrail logs in Amazon S3 with Amazon Athena, and write a SQL query for each account to list the calls made with the access key.
BB. Enable Amazon Detective through the organization administrator account, then open the user's profile from the finding to see its API activity, locations and related identities.
CC. Turn on GuardDuty S3 Protection and EKS Protection in all accounts, and read the new findings that appear for the same access key over the coming weeks.
DD. Search the VPC flow logs in CloudWatch Logs Insights for traffic from the unusual country, and treat the source addresses as the list of resources the user touched.
Show the answer and explanation
Answer: B
A. Wrong: Athena can answer the question, but the analysts must write and check SQL for each account, which they cannot do in one shift. The result is a table, not the visual view of relationships that the team wants.
B. Right: Correct. Detective builds behavior graphs from CloudTrail, VPC flow logs and GuardDuty data, and it shows an identity's activity and relationships without SQL. It keeps the data for up to a year, which covers the 90-day need. Learn more: What is Amazon Detective? (opens in a new tab)
C. Wrong: New findings show only what the service detects from now on, not what the identity did in the past month. The team needs history for the investigation, not new detections.
D. Wrong: Flow logs record network traffic, not API calls, so they cannot show what the identity did or which resources it changed. The source addresses also do not identify the principal behind the keys.
Explanation
Amazon Detective builds behavior graphs from logs that the accounts already produce, so analysts can pivot from a finding to an identity's activity and relationships. The retained history covers the 90-day need without writing SQL. Athena, new detections and flow logs each fail a stated requirement.
Want more on Scoping events and root cause analysis (Detective)? The 5 full-length practice sets have 8 more Scoping events and root cause analysis (Detective) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Scoping events and root cause analysis (Detective)