ANS-C01 Network Security, Compliance and Governance Practice Question
A company needs to ensure that all API calls to AWS services are logged and monitored for suspicious activity. Additionally, any API call that creates a security group rule should trigger an immediate notification. Which combination of services should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail and Amazon CloudWatch Events
AWS CloudTrail records all API calls to AWS services, enabling logging and monitoring. Amazon CloudWatch Events (now Amazon EventBridge) can be configured to trigger notifications based on specific API events, such as creating a security group rule via the ec2:AuthorizeSecurityGroupIngress API call. Option A is incorrect because VPC Flow Logs capture network traffic metadata, not API calls. Option C is incorrect because AWS Config evaluates resource configuration and compliance, not API call logging; Amazon SNS alone does not provide monitoring capabilities. Option D is incorrect because AWS Shield provides DDoS protection and AWS WAF is a web application firewall, neither of which log API calls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC Flow Logs and Amazon CloudWatch
Why it's wrong here
Flow logs capture network traffic, not API calls.
- ✓
AWS CloudTrail and Amazon CloudWatch Events
Why this is correct
CloudTrail logs API calls; CloudWatch Events can trigger alerts.
- ✗
AWS Config and Amazon SNS
Why it's wrong here
Config tracks configuration changes, not API calls.
- ✗
AWS Shield and AWS WAF
Why it's wrong here
Shield and WAF are for protection, not logging.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.