SCS-C03 Incident Response Practice Question
An incident response team discovers an unauthorized IAM user created an access key in a production environment. The team must identify the exact time of key creation and the IP address used for the call. Which AWS service provides this forensic detail?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail is the primary service for auditing API calls within an AWS account. It logs the identity of the caller, the time of the event, the source IP address, and the specific request parameters. In incident response, CloudTrail is critical for reconstructing a timeline of events and determining the scope of unauthorized access, ensuring that remediation efforts are targeted and effective based on accurate forensic data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config is designed to track resource configuration changes over time rather than recording user API activity. While it can detect when a resource was created, it does not provide the specific source IP address or the request context required for investigating unauthorized access activity.
- ✗
Amazon GuardDuty
Why it's wrong here
GuardDuty is an intelligent threat detection service that monitors for malicious activity. While it might alert on anomalous API calls, it does not serve as the primary audit log repository for granular forensic details like specific API request parameters or source IP metadata for every single call.
- ✓
AWS CloudTrail
Why this is correct
CloudTrail maintains a complete history of AWS API calls made by users, roles, or services. By querying CloudTrail event logs via CloudWatch Logs Insights or Athena, investigators can pinpoint the exact timestamp, user identity, and source IP address associated with the specific IAM access key creation event.
- ✗
AWS CloudWatch Metrics
Why it's wrong here
CloudWatch Metrics provides numerical data points over time, such as CPU utilization or request counts. It lacks the deep packet or event-level inspection capabilities required to extract specific metadata like source IP addresses or the unique identifiers associated with IAM user API calls during an incident.
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.