DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Config

  Why it's wrong here

  AWS Config records and evaluates resource configurations against compliance rules, such as checking whether an EC2 instance has the correct tags or whether a security group permits unrestricted SSH access. It does not capture or analyze AWS API calls, so it cannot determine whether a specific request was authorized or detect who invoked an action. Config sees the resulting state of a resource, not the API call or its authentication context.

• ✗

  Amazon S3

  Why it's wrong here

  Amazon S3 is a highly durable object storage service designed to store and retrieve any amount of data, not a security monitoring service. While S3 can write server access logs and CloudTrail can record S3 data events, S3 itself does not inspect or analyze API activity for unauthorized calls. Any monitoring would require an external service like GuardDuty or CloudTrail to consume and interpret those logs.

• ✗

  Amazon CloudWatch Logs

  Why it's wrong here

  Amazon CloudWatch Logs is a central place to ingest, store, and query log files from various AWS services, including CloudTrail, VPC Flow Logs, and application logs. It does not inherently perform security analysis; without custom metric filters, alarms, or integration with other services, it simply retains log records. Detecting unauthorized calls would require you to build your own query and alerting logic, unlike the built-in detection provided by GuardDuty.

• ✓

  AWS CloudTrail

  Why this is correct

  AWS CloudTrail is the primary service for recording API activity in an AWS account, capturing every management and data event with details like the caller's identity, the action, the resource, and the timestamp. By enabling CloudTrail in all regions and with appropriate event types, you can inspect logs to identify unauthorized attempts, such as failed authentication or IAM policy denials. CloudTrail provides the raw evidence needed for security analysis and is the foundational data source for services like GuardDuty.

• ✓

  Amazon GuardDuty

  Why this is correct

  Amazon GuardDuty is a threat detection service that continuously analyzes AWS activity using machine learning, anomaly detection, and threat intelligence feeds. It consumes CloudTrail management and data events, VPC Flow Logs, and DNS logs to identify suspicious patterns such as compromised credentials, unusual API calls, or crypto-mining behavior. GuardDuty actively generates alerts (findings) for unauthorized activity, while CloudTrail only records the events without interpreting them.

Go deeper

Related to this question