What's changed: Deepened SCS-C02 Chapter 1 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)
1.1Threat Detection
Understand threat detection—GuardDuty, Inspector, Macie, Detective, and IAM Access Analyzer. Find threats, vulnerabilities, and sensitive-data exposure from logs and activity.
Security starts with finding threats. AWS offers purpose-built detection services.
1.1.1Choosing detection services
- GuardDuty: ML threat/anomaly detection from logs (VPC Flow/DNS/CloudTrail).
- Inspector: auto-scan vulnerabilities in EC2/ECR/Lambda.
- Macie: discover/classify sensitive data (PII) in S3.
- Detective / Access Analyzer: Detective correlates findings for investigation, Access Analyzer analyzes excess permissions/external exposure.
Common on SCS-C02: threat detection = GuardDuty, vulnerability scan = Inspector, S3 sensitive data = Macie, investigate attack timeline = Detective, excess permissions/external exposure = IAM Access Analyzer. Don’t mix up the roles (detect/scan/classify/investigate/analyze).
GuardDuty automatically ingests VPC Flow Logs, DNS logs, and CloudTrail, detecting without extra log setup.
SCS-C02 tests precisely separating detection-service roles and operating them org-wide. GuardDuty ingests VPC flow logs, DNS logs, and CloudTrail (management/S3/Lambda data events) behind the scenes, using ML and threat intel to detect C2 traffic, crypto mining, anomalous API calls, and compromised-credential signs. Protection plans (S3, EKS, Malware, RDS Protection, etc.) extend coverage. Inspector continuously scans EC2, ECR images, and Lambda, assessing CVEs and reachability; Macie discovers/classifies PII/sensitive data in S3. Detective builds an entity behavior graph from GuardDuty/CloudTrail/VPC flow logs to investigate the "why, from where, how far" of findings over time (investigation, not detection). IAM Access Analyzer finds externally exposed S3/roles/KMS, analyzes unused access, and validates/generates policies. Across an org, aggregate each service to a delegated administrator account to manage members centrally, with findings aggregated to Security Hub in ASFF. The key is to not confuse "threat behavior = GuardDuty / vulnerabilities = Inspector / sensitive data = Macie / investigation = Detective / permissions & exposure = Access Analyzer," and to operate org-wide via a delegated administrator.
| Purpose | Service | Target |
|---|---|---|
| Threat behavior detection | GuardDuty | ML on logs (C2/anomalous API) |
| Vulnerability scanning | Inspector | CVEs in EC2/ECR/Lambda |
| Sensitive-data discovery | Macie | Classify PII in S3 |
| Investigation/perm analysis | Detective / Access Analyzer | Timeline / excess perms, exposure |
Scenario: In a multi-account environment, view threat detection, vulnerabilities, and sensitive-data exposure org-wide in one place. → Aggregate GuardDuty/Inspector/Macie/Security Hub each to a delegated administrator account to manage member accounts centrally. Collect findings in Security Hub, filtering by severity. From GuardDuty findings, investigate the timeline in Detective, and continuously surface excess permissions/external exposure with IAM Access Analyzer.
FAQ: GuardDuty vs Detective? GuardDuty is "detection"—ML on logs to find threat signs and emit findings. Detective is "investigation"—from those findings it draws an entity behavior graph and timeline to dig into "root cause and scope." Neither alone suffices; use the flow detection (GuardDuty) → investigation (Detective).
Exam trap: Choosing GuardDuty for "EC2/container vulnerability scanning" is wrong—that is Inspector. GuardDuty is behavior-based threat detection, not a CVE scanner. Likewise, "S3 sensitive-data discovery" is Macie, "investigate attack timeline" is Detective, and "analyze excess permissions/external exposure" is IAM Access Analyzer. Keep roles strictly distinct.
1.1.2Section summary
- Detect = GuardDuty (threats)/Inspector (vulns)/Macie (sensitive data)
- Investigate/analyze = Detective / IAM Access Analyzer
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Continuously detect suspicious API usage/compromise from logs via ML. What?
Q2. Auto-discover and classify PII stored in S3. What?
Q3. Investigate an attack timeline and related events from GuardDuty findings. What?