DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  AWS CloudTrail

  Why this is correct

  AWS CloudTrail is the primary service that records all API activity in an AWS account, capturing the identity, time, source IP, and request parameters for every call. Enabling CloudTrail across all regions and using events to build a baseline of expected behavior lets security teams flag anomalies such as unusual IAM roles, foreign IP addresses, or credential changes. It is the foundational data source for API-level anomaly detection, and its Insights feature can automatically identify unusual API patterns like mass resource deletion or unusual access timing.

• ✗

  Amazon Inspector

  Why it's wrong here

  Amazon Inspector is a vulnerability management service that continuously scans EC2 instances, container images, and Lambda functions for software vulnerabilities, unintended network exposure, and deviations from security best practices. It does not ingest, record, or analyze API call history, so it cannot detect anomalous behavior in the sequence or frequency of API calls. Inspector's findings focus on CVEs, network reachability, and package risks, not on who called which API or when.

• ✓

  Amazon CloudWatch Logs

  Why this is correct

  Amazon CloudWatch Logs supports monitoring and anomaly detection by serving as the aggregation and alerting layer for API activity. When CloudTrail events are streamed to CloudWatch Logs, you can use metric filters, Logs Insights queries, and anomaly detection alarms to identify patterns such as a sudden spike in failed authentication calls or access from unexpected geolocations. It is correct because it enables real-time and near-real-time operational response to anomalous API call patterns, even though the original event data is generated by CloudTrail.

• ✗

  AWS Config

  Why it's wrong here

  AWS Config tracks configuration changes to AWS resources and evaluates them against compliance rules, creating a timeline of resource state changes. It does not record the API calls that caused those changes, nor does it analyze caller behavior, frequency, or source IPs. Config is designed for resource drift detection and compliance auditing, not for reviewing the API call stream, so it cannot detect an anomalous API call in progress or as a pattern.

• ✓

  Amazon GuardDuty

  Why this is correct

  Amazon GuardDuty is a threat detection service that continuously analyzes CloudTrail management events, VPC Flow Logs, and DNS logs using machine learning and integrated threat intelligence. It specifically detects anomalous API call activity such as credential exfiltration, privilege escalation, or access from known malicious IPs, and raises severity-rated findings. GuardDuty consumes CloudTrail logs automatically and is purpose-built for identifying behavior that deviates from established baselines, making it directly applicable to the company's requirement.

Go deeper

Related to this question