SCS-C03 Incident Response Practice Question
A security engineer investigating a security alert discovers that an IAM role in an AWS account has been modified by an unknown external entity. The engineer needs to determine the exact API call that introduced the malicious policy change and identify the associated source IP address. Which AWS service provides the most definitive and historically accurate audit trail for this investigation?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Search AWS CloudTrail management event history using Amazon Athena or the AWS CLI to extract the specific PutRolePolicy event record.
AWS CloudTrail records all API calls and management events across the AWS environment, capturing caller identity, source IP addresses, and exact timestamps. By querying CloudTrail logs, security teams can reconstruct the entire attack chain, determine the extent of credential compromise, and identify policy modifications accurately. This historical record is foundational for effective cloud security incident response and forensic analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Query Amazon CloudWatch Logs metric filters to identify anomalous spikes in IAM role modification API error rates.
Why it's wrong here
CloudWatch Logs metric filters track numerical patterns and text occurrences within log streams but do not preserve granular caller identities or source IP addresses. Relying solely on metrics lacks the detailed event payload required for definitive forensic attribution.
- ✗
Analyze Amazon VPC Flow Logs to trace inbound TCP connections targeting the AWS Management Console during the suspected modification window.
Why it's wrong here
VPC Flow Logs capture IP traffic metadata at the network interface level but cannot decode proprietary AWS API calls or IAM actions. Network traffic logs alone cannot determine which specific IAM role policy was altered or who performed the call.
- ✗
Review AWS Trusted Advisor security recommendations to identify unencrypted IAM policies and overly permissive trust relationships.
Why it's wrong here
Trusted Advisor provides static configuration assessments and best-practice checks rather than real-time forensic event logging. It cannot identify historical API call origins or provide the chronological timeline needed for incident investigation.
- ✓
Search AWS CloudTrail management event history using Amazon Athena or the AWS CLI to extract the specific PutRolePolicy event record.
Why this is correct
CloudTrail logs record complete event metadata for management actions, including the precise API action, user agent, and source IP address. This enables security teams to pinpoint the exact moment of compromise and trace the attacker's operational footprint.
About these practice questions
One of 99 original SCS-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.