SCS-C02 Amazon GuardDuty Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Amazon CloudWatch Logs

  Why it's wrong here

  Amazon CloudWatch Logs is designed to ingest, store, and search log data from applications and AWS services, but it has no built-in machine learning model specifically trained to identify anomalous IAM sign-in behavior. You could use CloudWatch Logs Insights to query CloudTrail events after sending them there, but any alerting would rely on manually defined metric filters or static threshold rules, such as counting denied API calls. It cannot natively detect behavioral deviations like a login from an unusual geographic region without extensive custom logic.

• ✗

  AWS Config

  Why it's wrong here

  AWS Config continuously records and evaluates changes to AWS resource configurations, such as security group rule modifications or whether an S3 bucket is publicly accessible. It has no visibility into IAM user sign-in events or the contextual sequence of API calls made by a principal, because its data model is based on resource state rather than user activity. Its compliance rules are designed to enforce infrastructure standards, not to identify anomalous login locations or unusual IAM user actions, so it cannot produce the needed alerts.

• ✓

  Amazon GuardDuty

  Why this is correct

  Amazon GuardDuty is a managed threat detection service that continuously analyzes CloudTrail event logs, VPC Flow Logs, and DNS query logs using machine learning models and integrated threat intelligence to identify anomalous IAM behavior. It establishes a baseline of normal user activity and generates findings when it detects deviations, such as a logon from a known malicious IP, an unusual geolocation sign-in, or API calls made from a compromised credential. GuardDuty is purpose-built to alert on these anomalies and can automatically send findings to Amazon EventBridge for response.

• ✗

  IAM Access Analyzer

  Why it's wrong here

  IAM Access Analyzer is a policy-analysis tool that scans resource-based policies, such as S3 bucket policies, KMS key policies, and IAM role trust policies, to identify resources shared with an entity outside your AWS account. It does not monitor IAM user authentication events, source IP addresses, or API call patterns, and it does not apply threat intelligence or establish behavioral baselines for user activity. Its purpose is to reduce unintended external access to resources through policy analysis, not to detect anomalous IAM user behavior.

• ✓

  AWS CloudTrail

  Why this is correct

  AWS CloudTrail provides the authoritative audit trail of every IAM user sign-in event and API call made in an AWS account, capturing details such as the user identity, source IP address, user agent, and event timestamp. This raw telemetry is the underlying data source that enables detection of anomalies such as logins from unusual locations or impossible travel patterns. While CloudTrail alone does not perform anomaly detection, its event records are essential for any service or custom solution that monitors identity-based activity.

Go deeper

Related to this question