SCS-C02 Security Logging and Monitoring Practice Question
A company is using AWS CloudTrail and wants to detect when an IAM user performs a specific action, such as stopping an EC2 instance. The security engineer needs to set up a real-time notification. Which THREE steps should the engineer take? (Choose THREE.)
⚠ Common exam trap
It's easy for candidates to confuse services like QuickSight or Athena for real-time monitoring, but they are designed for historical analysis and visualization, not for triggering real-time notifications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a metric filter in CloudWatch Logs to match the StopInstances event
A metric filter in CloudWatch Logs can parse CloudTrail log events for the 'StopInstances' API call and convert it into a CloudWatch metric. This metric can then trigger an alarm for real-time notification, enabling the security engineer to detect the specific action as required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a metric filter in CloudWatch Logs to match the StopInstances event
Why this is correct
A metric filter in CloudWatch Logs inspects incoming log events and matches patterns such as { $.eventName = "StopInstances" }. Each matching event increments a custom metric (e.g., StopInstancesCount), which is what turns raw log data into a numeric measure that a CloudWatch alarm can monitor. Without this metric filter, CloudWatch Logs data remains unstructured and cannot directly trigger alerts.
- ✓
Create a CloudTrail trail that delivers logs to CloudWatch Logs
Why this is correct
To enable CloudWatch-based monitoring, the CloudTrail trail must be configured to deliver event logs to a CloudWatch Logs log group, not just to an S3 bucket. This delivery is a prerequisite because metric filters and alarms operate on CloudWatch Logs streams; without this trail configuration, the CloudTrail events never enter CloudWatch Logs, so no metric can be created.
- ✗
Use Amazon QuickSight to visualize CloudTrail logs
Why it's wrong here
Amazon QuickSight is a business intelligence service designed for interactive dashboards and embedded visualizations; it is not intended to evaluate incoming log events in real time or trigger incident notifications. Even though QuickSight can connect to CloudTrail data for trend analysis and reporting, it lacks an alarm engine and direct SNS integration, making it unsuitable for this detection and alerting use case.
- ✓
Create a CloudWatch alarm on the metric and configure it to send an SNS notification
Why this is correct
The CloudWatch alarm continuously monitors the custom metric emitted by the metric filter and, when the count of StopInstances events breaches a defined threshold, it transitions to ALARM state and invokes an SNS topic to send email, SMS, or other notifications. This alarm is the alerting component that closes the loop on detection, but it depends on the metric filter having already produced the underlying metric.
- ✗
Use Amazon Athena to query CloudTrail logs in S3
Why it's wrong here
Amazon Athena is an interactive query service that uses SQL to analyze data directly in S3; you could run an on-demand query against CloudTrail logs to find StopInstances events, but this is a manual, batch analysis that does not run continuously. Athena has no built-in mechanism to trigger a notification when a new event arrives, so it cannot provide the real-time or automated alerting that a CloudWatch alarm with SNS delivers.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.