Study SCS-C03 troubleshooting for missing logs, broken alerting, permissions gaps, and misconfigured monitoring pipelines.
SCS-C03 troubleshooting questions are about proving where the detection pipeline failed. The exam often gives you a symptom such as missing logs, missing alerts, or incomplete findings, and expects you to check the source, permissions, configuration, and destination in the right order.
The current SCS-C03 domain page focuses this task on two broad skills:
That sounds simple, but it drives many high-value questions because AWS knows candidates often jump to the wrong layer first.
Use this order when a signal is missing:
This order matters because many “alerting” incidents are actually source or delivery failures.
| Symptom | Strongest first suspicion | Why |
|---|---|---|
| No logs from a workload or service | Source configuration or agent problem | The signal may never have been produced |
| Logs exist but never arrive centrally | Delivery permissions or destination mismatch | Source works, transfer path fails |
| Findings exist but no one sees them | Aggregation, subscription, or delegated-admin problem | Detection exists, visibility path fails |
| Metrics appear but alarms do not fire | Threshold, dimension, or alarm configuration issue | Alert logic is wrong, not the metric source |
| Queries return incomplete data | Wrong log source, retention gap, or parsing/correlation gap | Investigation path is incomplete |
This distinction is one of the easiest places to lose points.
If no CloudTrail records exist for the event, the issue is probably not Athena.
If the application never shipped logs, the issue is probably not Security Hub.
If GuardDuty generated findings but the SOC cannot see them centrally, the detector may be fine and the aggregation path may be broken.
Always ask:
SCS-C03 likes questions where the service is “enabled” but nothing arrives where expected.
That should make you think about:
The exam is often testing whether you can diagnose a broken permission path without disabling the secure design.
You should be comfortable reasoning about cases like:
When the signal is missing, debug the pipeline in order: source, permissions, destination, aggregation, alerting.
Continue to 2. Incident Response after this chapter once you can tell whether the security signal is missing, delayed, or just routed badly.