DOP-C02 Security and Compliance Practice Question
Which TWO AWS services can be used to monitor for unauthorized API calls in an AWS account? (Choose two.)
⚠ Common exam trap
DOP-C02 often tests whether candidates pick AWS Config (configuration compliance) or CloudWatch Logs (log storage) instead of CloudTrail and GuardDuty for detecting unauthorized API activity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail (D) is correct because it records every API call made in the account as events, including the identity of the caller, source IP, and time, which lets you detect unauthorized or suspicious API activity. Amazon GuardDuty (E) is correct because it continuously analyzes CloudTrail management and data events, VPC Flow Logs, and DNS logs using threat intelligence and machine learning to surface findings such as anomalous or unauthorized API calls. AWS Config (A) is not the right choice because it evaluates resource configuration compliance and records configuration changes, not the authorization status of API callers. Amazon S3 (B) is only object storage and does not monitor API activity. Amazon CloudWatch Logs (C) can store and query log data, but by itself it does not capture or detect unauthorized API calls without CloudTrail as the source.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config records and evaluates resource configurations against compliance rules, such as checking whether an EC2 instance has the correct tags or whether a security group permits unrestricted SSH access. It does not capture or analyze AWS API calls, so it cannot determine whether a specific request was authorized or detect who invoked an action. Config sees the resulting state of a resource, not the API call or its authentication context.
- ✗
Amazon S3
Why it's wrong here
Amazon S3 is a highly durable object storage service designed to store and retrieve any amount of data, not a security monitoring service. While S3 can write server access logs and CloudTrail can record S3 data events, S3 itself does not inspect or analyze API activity for unauthorized calls. Any monitoring would require an external service like GuardDuty or CloudTrail to consume and interpret those logs.
- ✗
Amazon CloudWatch Logs
Why it's wrong here
Amazon CloudWatch Logs is a central place to ingest, store, and query log files from various AWS services, including CloudTrail, VPC Flow Logs, and application logs. It does not inherently perform security analysis; without custom metric filters, alarms, or integration with other services, it simply retains log records. Detecting unauthorized calls would require you to build your own query and alerting logic, unlike the built-in detection provided by GuardDuty.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is the primary service for recording API activity in an AWS account, capturing every management and data event with details like the caller's identity, the action, the resource, and the timestamp. By enabling CloudTrail in all regions and with appropriate event types, you can inspect logs to identify unauthorized attempts, such as failed authentication or IAM policy denials. CloudTrail provides the raw evidence needed for security analysis and is the foundational data source for services like GuardDuty.
- ✓
Amazon GuardDuty
Why this is correct
Amazon GuardDuty is a threat detection service that continuously analyzes AWS activity using machine learning, anomaly detection, and threat intelligence feeds. It consumes CloudTrail management and data events, VPC Flow Logs, and DNS logs to identify suspicious patterns such as compromised credentials, unusual API calls, or crypto-mining behavior. GuardDuty actively generates alerts (findings) for unauthorized activity, while CloudTrail only records the events without interpreting them.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,298 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.