SCS-C02 Security Logging and Monitoring Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Lambda

  Why it's wrong here

  AWS Lambda is serverless compute that runs code in response to events such as an S3 object upload or an API Gateway request. It can serve as a remediation tool or as the runtime for a custom AWS Config rule, but it has no native mechanism to assess or record resource configuration compliance. By itself, Lambda cannot determine whether a change made a resource noncompliant with organizational policies, so it cannot be the primary evaluation service.

• ✗

  AWS Security Hub

  Why it's wrong here

  AWS Security Hub is a cloud security posture management service that aggregates and prioritizes security findings from services like GuardDuty, Inspector, and Firewall Manager across an AWS environment. It can display noncompliant Config rules through an integration, but it does not run compliance evaluations; the underlying Config service performs that evaluation. Enabling Security Hub alone will not record resource changes or assess whether those changes violate Config rules.

• ✗

  Amazon GuardDuty

  Why it's wrong here

  Amazon GuardDuty is a machine-learning-based threat detection service that analyzes data sources such as AWS CloudTrail management events, VPC Flow Logs, and DNS query logs. It identifies threats like malicious IP addresses or unusual API call patterns, but it is not designed to check whether a resource's configuration matches a desired policy. GuardDuty findings relate to active security threats, whereas configuration compliance is a state-based assessment handled by AWS Config.

• ✗

  AWS CloudTrail

  Why it's wrong here

  AWS CloudTrail records the API activity in an account, capturing the who-what-when of actions such as creating an S3 bucket or modifying an IAM role. It does not maintain the resulting resource configuration state, nor does it compare that state against a compliance policy. While CloudTrail can help audit what changed, AWS Config is required to evaluate the configuration after the change and notify when it is noncompliant.

• ✓

  AWS Config with a custom rule that triggers an SNS notification

  Why this is correct

  AWS Config records resource configuration changes and can evaluate those changes against rules that define desired configurations. A custom rule implemented as a Lambda function returns a compliance status based on a configuration item, and AWS Config can publish the result to an SNS topic when a resource becomes noncompliant. This combination enables real-time notification and corrective workflow each time a configuration change occurs, which is exactly what the requirement needs.

Go deeper

Related to this question