ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a security group that allows inbound SSH (port 22) from 0.0.0.0/0. A security engineer discovers that an EC2 instance was compromised via SSH. The engineer needs to identify which IAM user created the overly permissive security group rule. Which AWS service or feature should the engineer use?
⚠ Common exam trap
AWS often tests the distinction between services that log API calls (CloudTrail) versus those that monitor network traffic (VPC Flow Logs) or detect threats (GuardDuty), and the trap here is assuming that VPC Flow Logs or AWS Config can identify the IAM user responsible for a security group rule change.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail is the correct service because it records API calls made within the AWS environment, including the AuthorizeSecurityGroupIngress API call that created the overly permissive security group rule. By searching CloudTrail logs for this specific API event, the engineer can identify the IAM user, source IP, and timestamp of the rule creation. VPC Flow Logs, AWS Config, and GuardDuty do not capture IAM user identity for API-level changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC Flow Logs
Why it's wrong here
VPC Flow Logs capture metadata about IP traffic reaching an ENI, such as source/destination addresses and ports, but they do not log which IAM user created a security group rule. The engineer needs to audit identity-driven changes to security group configurations, not network traffic patterns. This option is tempting because flow logs can reveal the source IP of the SSH connection that compromised the instance, which might seem to identify the attacker; however, the question specifically asks for the IAM user who *created* the rule, not the external IP that exploited it. In a scenario where the goal is to trace the origin of malicious traffic after a breach, VPC Flow Logs would be the correct choice.
- ✗
AWS Config
Why it's wrong here
AWS Config shows configuration changes but not the identity of the user making the change.
- ✗
Amazon GuardDuty
Why it's wrong here
GuardDuty detects malicious activity but does not log API caller identity.
- ✓
AWS CloudTrail
Why this is correct
CloudTrail records API calls and the IAM user who made them.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.