DOP-C02 Security and Compliance Practice Question
Which TWO AWS services can be used to monitor and detect unauthorized access to AWS resources? (Choose two.)
⚠ Common exam trap
It's easy for candidates to confuse AWS Config (which tracks configuration changes) with a security monitoring service, but Config does not analyze logs or detect unauthorized access; it only records resource state changes and evaluates compliance rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior by analyzing VPC Flow Logs, DNS logs, and AWS CloudTrail management and data events. It uses machine learning and integrated threat intelligence to detect anomalies such as unusual API calls, crypto-mining activity, or compromised credentials, making it a correct choice for detecting unauthorized access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Shield
Why it's wrong here
AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards web applications from volumetric, state-exhaustion, and application-layer attacks. It works at the network and transport edge and does not examine IAM identities, API call patterns, or user behavior. Shield's purpose is to ensure availability, not to detect unauthorized access, which requires analysis of account-level activity. It automatically mitigates attacks but will never report a suspicious 'GetSecretValue' call from an unknown IP.
- ✓
Amazon GuardDuty
Why this is correct
Amazon GuardDuty is a continuous threat detection service that ingests and analyzes AWS CloudTrail management and data events, VPC Flow Logs, and DNS query logs. Using machine learning, anomaly detection, and integrated threat intelligence, it identifies reconnaissance, credential compromise, crypto-mining, and other unauthorized behavior. GuardDuty generates prioritized findings in the console and can trigger automated responses via Amazon EventBridge. Because it actively correlates across logs, it directly fulfills the 'monitor and detect unauthorized access' requirement.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management service that scans AWS workloads for software vulnerabilities and unintended network exposure. It evaluates EC2 instances, container images, and Lambda functions against CVE databases and compliance standards like CIS and NIST. Inspector does not consume CloudTrail or VPC Flow Logs, and it cannot detect an attacker using stolen credentials to call an API. It simply reports whether a resource has known security weaknesses, not whether anyone is exploiting them or performing unauthorized actions.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail records every API call made by or on behalf of an AWS account, capturing the identity, source IP, user agent, and event details. This audit log is essential for detecting unauthorized access attempts—for example, a 'ListBuckets' call with 'AccessDenied' errors—but CloudTrail itself only stores events; it does not actively interpret or alert on them. You must query the logs with Athena, Amazon Elasticsearch, or a third-party SIEM to discover suspicious patterns. Moreover, GuardDuty consumes CloudTrail logs as a data source to provide that active detection automatically.
- ✗
AWS Config
Why it's wrong here
AWS Config is a service that records and evaluates the configuration state of AWS resources against custom or managed rules. It helps you assess whether a resource is compliant with internal policies—such as 'EC2 instances must have a specific tag'—and detects configuration drift over time. Config does not process API calls or user actions; it sees resource attributes but not the identity behind an action. Therefore, it cannot detect that an IAM user suddenly started terminating EC2 instances, which is a classic unauthorized access scenario.
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.