SCS-C03 · Domain 1 of 6

SCS-C03 Domain 1: Detection

Domain 1 tests how you see threats in AWS: designing monitoring and alerting for an account or organization, building logging pipelines and data lakes, and fixing detection setups that fail silently.

Exam weight
16%
Official task statements
3
Estimated questions estimate
~8
Suggested study time estimate
12–16 hrs

About 13 min read Reviewed October 2026

Overview

Detection has three task statements. Task 1.1 covers monitoring and alerting across an account or organization: deciding what a workload needs watched, aggregating security events, and turning signals from Amazon GuardDuty, AWS Security Hub, Amazon Security Lake and Amazon Macie into metrics, alarms and dashboards, with AWS Config conformance packs and Systems Manager State Manager running regular assessments. Task 1.2 covers logging: an organization CloudTrail trail, a dedicated CloudWatch logging account, the CloudWatch agent, Security Lake, analysis with CloudWatch Logs Insights and Athena, and network log sources such as VPC Flow Logs, transit gateway flow logs and Route 53 Resolver query logs. Task 1.3 covers troubleshooting when logs or alerts do not arrive.

SCS-C03 has been the only live version since December 2, 2025; SCS-C02 ended on December 1, 2025. In the new layout, detection and incident response are split into separate domains.

How it's tested

Domain 1 scenarios describe an organization, a threat or a gap in visibility and ask which service, log source or configuration closes it. Several answers are usually technically possible, so the deciding factors are scope across accounts, least operational overhead and whether the chosen source records the exact event.

  • Pick the log source

    An activity such as a DNS lookup, an S3 object read or a rejected connection is described, and you choose the log that captures it.

  • Centralize findings

    A multi-account organization needs one view of threats, and you pick delegated administrators, aggregation Regions or Security Lake.

  • Fix silent monitoring

    Logs or alarms are missing, and you trace the cause to IAM permissions, agent configuration, a disabled setting or a wrong log group.

Reasoning it through

A team sees no CloudWatch log entries from a new fleet of EC2 instances even though the CloudWatch agent is installed. The likely causes are an instance profile without logs:PutLogEvents permission or an agent configuration file pointing at the wrong path. Rebuilding the dashboard or enabling GuardDuty does nothing for this gap, because the data never leaves the instance in the first place.

Task statements 3

Official task statements from the Amazon Web Services outline, in outline order.

1.1 Design and implement monitoring and alerting solutions for an AWS account or organizationMonitoring requirements, event aggregation, alarms, dashboards and automated assessments.
What it means
This task statement covers analyzing a workload to decide what must be monitored, designing health checks and monitoring strategies, aggregating security events across accounts, building metrics, alerts and dashboards from GuardDuty, Security Lake, Security Hub and Macie, and automating recurring assessments with Config conformance packs, Security Hub standards and Systems Manager State Manager.
What to understand
GuardDuty analyzes CloudTrail, VPC Flow Logs, DNS logs and runtime data to produce threat findings; Macie finds sensitive data in S3; Security Hub collects findings and runs best-practice checks; Security Lake normalizes logs into OCSF in your own S3 bucket. In an organization, assign a delegated administrator and auto-enable members. Amazon EventBridge rules on findings drive SNS notifications or Lambda responses, and CloudWatch metric filters plus alarms catch patterns such as root sign-ins.
How it shows up
Expect a multi-account requirement for central visibility with minimal effort; delegated administration and auto-enablement usually beat per-account scripts.
Common confusion
Treating Security Hub as a threat detector; it aggregates and scores findings, while GuardDuty performs the detection.
1.2 Design and implement logging solutionsLog sources, organization trails, logging accounts, log lakes, analysis and network logs.
What it means
This task statement covers choosing what to log and where to keep it, configuring CloudTrail organization trails, a dedicated CloudWatch logging account and the CloudWatch agent, building log storage and data lakes with Security Lake, analyzing logs with Logs Insights, Athena and Security Hub, normalizing and correlating logs with OpenSearch Service, Lambda and Managed Grafana, and picking network sources such as VPC Flow Logs, transit gateway flow logs and Route 53 Resolver logs.
What to understand
CloudTrail records management events by default; S3 object-level and Lambda invoke activity need data events. An organization trail from the management account covers every member and can deliver to a central log archive bucket protected by a bucket policy and Object Lock. VPC Flow Logs show IPs, ports, bytes and accept or reject decisions, never payloads. Route 53 Resolver query logs reveal DNS lookups to malicious domains. Athena queries logs in S3 cheaply, while Logs Insights queries CloudWatch log groups.
How it shows up
Look for the requirement that defines the source: DNS, API calls, object access or traffic between VPCs each points to a different log.
Common confusion
Expecting CloudTrail to show S3 GetObject calls without enabling data events for that bucket.
1.3 Troubleshoot security monitoring, logging, and alerting solutionsDiagnosing and fixing missing logs, broken alerts and misconfigured agents.
What it means
This task statement covers analyzing the function, permissions and configuration of resources that should produce logs, such as Lambda functions, API Gateway stages, health checks and CloudFront distributions, and remediating misconfigurations such as broken CloudWatch agent settings or logs that never appear.
What to understand
Most missing-log problems come down to three causes: the feature is not enabled (API Gateway execution logging needs an account-level CloudWatch role, CloudFront standard logging needs a destination), the writer lacks permission (a Lambda execution role without CloudWatch Logs actions, a bucket policy that blocks the delivery service), or the configuration points elsewhere (wrong Region, wrong log group, wrong file path in the agent). Check the resource policy and the role before rebuilding anything.
How it shows up
A symptom such as an empty log group is given, and you pick the smallest change that restores data flow.
Common confusion
Blaming the destination service when the source role or resource policy is denying log delivery.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Amazon GuardDuty

    Managed threat detection over CloudTrail, VPC Flow Logs, DNS logs and runtime telemetry.

    Remember
    No agents or log setup needed for foundational sources.
    Tested as
    Threat finding scenarios.
    Trap
    Expecting it to block traffic on its own.

  • AWS Security Hub

    Aggregates findings and runs security standards checks across accounts.

    Remember
    Needs AWS Config for its controls.
    Tested as
    Central view questions.
    Trap
    Calling it the source of threat intelligence.

  • Amazon Security Lake

    Centralizes security logs in OCSF format in an S3 data lake you own.

    Remember
    Normalization plus subscriber access for third-party tools.
    Tested as
    Log lake and SIEM integration questions.
    Trap
    Confusing it with CloudTrail Lake.

  • Delegated administrator

    A member account that manages a security service for the whole organization.

    Remember
    Keeps the management account out of daily operations.
    Tested as
    Organization-wide detection.
    Trap
    Enabling services account by account.

  • CloudTrail data events

    Object-level and function-level API activity such as S3 GetObject.

    Remember
    Off by default and billed separately.
    Tested as
    Who read this object questions.
    Trap
    Assuming management events include them.

  • Organization trail

    One trail created in the management account that logs every member account.

    Remember
    Members cannot disable it.
    Tested as
    Tamper-resistant audit logging.
    Trap
    Creating separate trails per account.

  • VPC Flow Logs

    Metadata about IP traffic: addresses, ports, protocol, bytes, action.

    Remember
    No payload content.
    Tested as
    Rejected connection or exfiltration volume questions.
    Trap
    Using them to inspect packet contents.

  • Route 53 Resolver query logs

    Records DNS queries made from within VPCs.

    Remember
    Best source for lookups of malicious domains.
    Tested as
    DNS exfiltration and C2 scenarios.
    Trap
    Looking for DNS queries in Flow Logs.

  • CloudWatch metric filters and alarms

    Turn log patterns into metrics and alert on thresholds.

    Remember
    Classic pattern for root logins or IAM changes.
    Tested as
    Alerting questions.
    Trap
    Forgetting the alarm needs an SNS action.

  • AWS Config conformance packs

    Bundles of Config rules and remediations deployed as one unit.

    Remember
    Can be deployed across an organization.
    Tested as
    Regular assessment questions.
    Trap
    Treating Config as a real-time threat detector.

  • Athena vs. Logs Insights

    Athena queries logs in S3; Logs Insights queries CloudWatch log groups.

    Remember
    Match the tool to where logs live.
    Tested as
    Log analysis questions.
    Trap
    Using Logs Insights on an S3 archive.

  • API Gateway and CloudFront logging

    Both require explicit configuration and roles or destinations.

    Remember
    API Gateway needs an account-level CloudWatch role.
    Tested as
    Troubleshooting questions.
    Trap
    Assuming logs are on by default.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Which log answers the question

ConceptMeaningKey differenceCommon trap
CloudTrail management events Control plane API calls Who changed a resource Expecting object reads
CloudTrail data events Data plane calls such as S3 GetObject Who touched data Assuming they are on by default
VPC Flow Logs Network flow metadata Who talked to whom and whether it was allowed Expecting payloads
Route 53 Resolver query logs DNS lookups from VPCs Which domains were resolved Searching Flow Logs for domain names

Detection and aggregation services

ConceptMeaningKey differenceCommon trap
GuardDuty Detects threats from logs and runtime data Produces findings Thinking it remediates by itself
Security Hub Aggregates findings and checks standards Central posture view Thinking it analyzes raw logs
Security Lake Normalized OCSF log lake Long-term storage and subscribers Treating it as a finding generator
Macie Finds sensitive data in S3 Data discovery Using it to find network threats

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Flow Logs for DNS

    What candidates pick
    Enable VPC Flow Logs to see which domains an instance queried.
    Why it looks right
    Flow Logs are the familiar network log.
    Why it's wrong
    Flow Logs record addresses and ports only; Route 53 Resolver query logs record the domain names requested from the VPC.

    Clue to watch for The question mentions domains, DNS or command-and-control lookups.

  2. Security Hub as detector

    What candidates pick
    Turn on Security Hub to detect compromised credentials.
    Why it looks right
    Security Hub shows findings on one screen.
    Why it's wrong
    Security Hub aggregates findings from other services; GuardDuty is what analyzes activity and raises the credential compromise finding.

    Clue to watch for The need is to detect, not to aggregate.

  3. Per-account trails

    What candidates pick
    Create a CloudTrail trail in every account with a script.
    Why it looks right
    It seems thorough.
    Why it's wrong
    An organization trail covers all current and future accounts, and member accounts cannot stop it, which is stronger and simpler.

    Clue to watch for New accounts keep being added and logs must be tamper resistant.

  4. Management events only

    What candidates pick
    Use the default trail to find who downloaded objects.
    Why it looks right
    CloudTrail is the audit log.
    Why it's wrong
    Object downloads are data events, which a default trail does not record, so the evidence was never captured.

    Clue to watch for Object-level or data-level access is the subject.

  5. Wrong analysis tool

    What candidates pick
    Run CloudWatch Logs Insights against logs archived in S3.
    Why it looks right
    Logs Insights is a fast query tool.
    Why it's wrong
    Logs Insights reads CloudWatch log groups; logs already in S3 are queried with Athena without reloading them.

    Clue to watch for Logs sit in an S3 bucket or Security Lake.

  6. Rebuild instead of fix permissions

    What candidates pick
    Recreate the Lambda function because its logs are missing.
    Why it looks right
    Starting fresh feels safe.
    Why it's wrong
    A Lambda execution role without CloudWatch Logs permissions blocks writes; adding the permission fixes it immediately.

    Clue to watch for The function runs but no log group or stream appears.

Answer framework

Apply these steps to any Domain 1 question about monitoring, logging or a detection gap.

  1. Name the exact activity to observe, such as an API call, object read, DNS query or network flow, before thinking about services.
  2. Map that activity to the log source that records it, enabling data events or resolver logging when the default sources miss it.
  3. Decide the scope and centralize with organization trails, delegated administrators and auto-enable so new accounts are covered.
  4. Choose where analysis happens: CloudWatch for near real-time alarms, Athena or Security Lake for large historical queries, Security Hub for findings.
  5. When data is missing, check enablement, role permissions and resource policies, then destination settings, and change the smallest thing that fixes the flow.

Practice question

A company with 60 AWS accounts in AWS Organizations must detect cryptocurrency mining and credential misuse in every account, including accounts created next year. The security team wants one place to review findings and the least ongoing effort. What should the team do?

Want more like this? The SCS-C03 practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Begin by mapping activity to evidence. Make a table with columns for API calls, object access, DNS, network flows, operating system logs and application logs, and write the AWS log source and the setting that enables it under each. Most Domain 1 questions become simple once you can do this from memory.

Next, build a small organization in a sandbox if you can. Create an organization trail, assign a delegated administrator for GuardDuty and Security Hub, and watch findings from a test account appear centrally. Generate GuardDuty sample findings and route them through EventBridge to an SNS topic. Add a metric filter and alarm for root user sign-ins.

Then break things on purpose. Remove a Lambda execution role's logging permission, point the CloudWatch agent at the wrong file, or skip the API Gateway account role, and note the exact symptom each produces. Finish by querying the same CloudTrail data with Logs Insights and with Athena so you know when each fits. Spend the last sessions on timed scenario questions, reading each one for the exact event that must be seen.

FAQ

How much of SCS-C03 is Domain 1?

Detection is 16% of scored content, about eight of the fifty scored questions, across three task statements covering monitoring, logging and troubleshooting.

Is SCS-C02 still available?

No. Per the AWS exam guide appendix, SCS-C02 was delivered until December 1, 2025, and SCS-C03 has been the only version since December 2, 2025.

How many questions and how long is the exam?

SCS-C03 has 65 questions, of which 50 are scored and 15 are unscored, in 170 minutes. The passing score is 750 on a scale of 100 to 1,000.

Do I need to know OCSF?

You should know that Security Lake stores logs in the Open Cybersecurity Schema Framework so different sources share one schema and third-party tools can subscribe. Field-level detail is unlikely.

What happened to the ASFF topic from SCS-C02?

The comparison appendix lists the AWS Security Finding Format as removed from this area, so expect fewer format questions and more design and troubleshooting.

Which detection services should I know best?

GuardDuty, Security Hub, Security Lake, Macie, CloudTrail, CloudWatch and AWS Config appear most often, along with network logs such as VPC Flow Logs and Route 53 Resolver query logs.

Are some exam languages being withdrawn?

Yes. The certification page states that the Simplified Chinese, Spanish (Latin America) and Portuguese (Brazil) versions retire after December 31, 2026.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have covered monitoring, alerting, logging pipelines and detection troubleshooting. Check whether you can match each scenario to the right log source and service under time pressure.

Take the SCS-C03 practice test Check your SCS-C03 readiness

Keep going