Exams / SCS-C03 / Study guide / Threat detection and findings (GuardDuty, Macie, Security Hub)
Threat detection and findings (GuardDuty, Macie, Security Hub): SCS-C03 study notes and practice questions
What to know about Threat detection and findings (GuardDuty, Macie, Security Hub) for the SCS-C03 exam, from the Detection domain (16% of the exam guide), then 2 free questions to test it. Part of the SCS-C03 study guide.
The exam describes an organization with many accounts and asks how to spot an attacker, an exposed data store or a risky configuration early, with as little setup per account as possible. Pick the managed service that matches the kind of finding, then pick the organization-wide setup that covers accounts created later.
What each service finds
Amazon GuardDuty analyzes CloudTrail management events, S3 data events, VPC Flow Logs, DNS logs and EKS audit logs to find threats such as compromised credentials, reconnaissance and cryptocurrency mining. It needs no agents for these sources. Runtime Monitoring adds visibility into container and EC2 activity through an agent, and Malware Protection scans S3 objects and EBS volumes for malware.
Extended threat detection in GuardDuty correlates related signals over time into attack sequences, so one finding can describe several steps of the same incident.
Amazon Macie discovers and classifies sensitive data, such as personal information, in S3 buckets. It answers “where is our sensitive data”, not “who is calling our APIs from an unusual place”.
AWS Security Hub, the newer service, brings together findings from GuardDuty, Amazon Inspector, Macie and Security Hub CSPM, adds exposure findings and ranks them by risk. Security Hub CSPM is the posture service: it runs security standards and control checks against your resources. Use the name Security Hub CSPM when a question is about standards or control checks.
Organization-wide setup
Designate a delegated administrator account, often the security or audit account, so one team manages GuardDuty, Security Hub and Macie for every member account. The management account makes the designation.
Turn on auto-enable for new accounts, so an account created next month is covered without a manual step.
Aggregate findings from several Regions into one home Region for a single view.
Send findings to EventBridge, so a rule can start an automated response or notify a chat channel.
How to choose
Scenario wording
Pick
Detect compromised credentials or cryptocurrency mining with no agents to deploy
GuardDuty
Find which S3 buckets hold personal data
Macie
Check accounts against security standards and control checks
Security Hub CSPM
One view of GuardDuty, Inspector and Macie findings across accounts
Security Hub with a delegated administrator and cross-Region aggregation
Show attack steps that unfold across several resources over time
GuardDuty Extended Threat Detection
Cover accounts created after the rollout without a manual step
Auto-enable with a delegated administrator
Common traps
Enabling GuardDuty account by account when a delegated administrator with auto-enable covers every current and future account.
Using Macie to detect unusual access. Macie classifies data; GuardDuty detects threats against your accounts.
Confusing the two Security Hub names. The posture checks are Security Hub CSPM, and the unified findings view is the newer Security Hub.
Treating suppression as a fix. Archiving or suppressing findings hides noise but does not remove the cause.
Assuming VPC Flow Logs show every DNS lookup. GuardDuty reads DNS logs itself, but your own DNS query records need Route 53 Resolver query logging.
A retailer runs 140 AWS accounts in one AWS Organizations organization. Each business unit owns its accounts, and the platform team creates new accounts every week.
The security team wants Amazon GuardDuty turned on in every account, including accounts created later, with all findings visible in one security tooling account. The security team must not run daily work from the management account, and no account owner should have to take a manual step.
Which TWO actions should the security team take? (Choose two.)
Choose two answers.
AA. Turn on GuardDuty in the management account, then send an email invitation from it to each member account when that account is created.
BB. From the management account, designate the security tooling account as the GuardDuty delegated administrator for the organization.
CC. Add a service control policy that denies guardduty:DeleteDetector, and ask each account owner to enable GuardDuty in their own account.
DD. In the delegated administrator account, set auto-enable to cover all member accounts, so that GuardDuty is turned on in existing accounts and in accounts that join later.
EE. Give the security team IAM users in the management account with GuardDuty administrator permissions, and review findings there each morning.
Show the answer and explanation
Answers: B, D
A. Wrong: Invitations need an acceptance step in each account, which is a manual step for the owner. Running detectors from the management account also breaks the rule that daily security work stays out of it.
B. Right: Correct. Designating a delegated administrator from the management account moves GuardDuty administration to the security tooling account, so daily work stays out of the management account. The delegated administrator can then see findings from every member account. Learn more: Managing multiple accounts in Amazon GuardDuty (opens in a new tab)
C. Wrong: A service control policy protects a detector from deletion, but it does not turn GuardDuty on. Each owner would have to enable it by hand, and the security team would still have no single place to see findings.
D. Right: Correct. Auto-enable for all member accounts turns on GuardDuty in the existing accounts and in each new account, without an invitation or a manual step by the owner. Together with the delegated administrator, it covers the accounts the platform team creates each week. Learn more: Managing multiple accounts in Amazon GuardDuty (opens in a new tab)
E. Wrong: This lets the team view findings, but it puts daily security work in the management account, which the team must avoid. It also gives many people broad access to the account that governs the whole organization.
Explanation
Turning on GuardDuty across an organization takes two parts: a delegated administrator account, designated from the management account, and auto-enable so that new accounts join without manual steps. The delegated administrator then collects findings from every member account in one place. Invitations and daily work in the management account both fail the stated requirements.
A logistics firm runs 180 AWS accounts in six Regions. Its security operations center wants all Security Hub CSPM findings visible in one Region, so that analysts work from one console.
A sandbox organizational unit produces many low-risk findings that clutter the queue. Analysts want those findings hidden from the main queue but kept for audit, and they want the change to be reversible. The security checks in the sandbox accounts must keep running.
Which solution meets these requirements?
Choose one answer.
AA. Disable the Security Hub CSPM controls in the sandbox accounts, so that no findings are created there in the first place.
BB. Turn on Security Hub CSPM cross-Region aggregation into one Region, then add an automation rule for the sandbox accounts that sets the workflow status to SUPPRESSED.
CC. Keep Security Hub separate in each Region, and have analysts open the six consoles in turn, filtering each one by sandbox account ID.
DD. Create an Amazon EventBridge rule in each Region that drops the sandbox findings from the Security Hub CSPM event stream before analysts see them in the console.
Show the answer and explanation
Answer: B
A. Wrong: Disabling the controls stops the checks, so the sandbox accounts would produce no findings at all. The requirement says the checks must keep running, and the audit trail would be incomplete.
B. Right: Correct. Cross-Region aggregation brings findings from all six Regions into one console. A suppression automation rule hides the matching findings from the default queue while keeping them for audit, and disabling the rule reverses the change. Learn more: Automation rules in AWS Security Hub (opens in a new tab)
C. Wrong: Separate Regions give no single view, which the operations center needs. Analysts would still see the sandbox noise in each console, so the filter would have to be repeated six times.
D. Wrong: Dropping events from the EventBridge stream does not remove the findings from Security Hub, so the console still shows them. The approach is also hard to reverse and gives no single console.
Explanation
Cross-Region aggregation gives the operations center one view of findings from every Region. An automation rule that sets the workflow status to suppressed hides the noisy sandbox findings without deleting them, and it can be reversed. Disabling controls, dropping events and separate consoles each break a stated requirement.
Want more on Threat detection and findings (GuardDuty, Macie, Security Hub)? The 5 full-length practice sets have 7 more Threat detection and findings (GuardDuty, Macie, Security Hub) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Threat detection and findings (GuardDuty, Macie, Security Hub)