SCS-C02 Management and Security Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Amazon CloudWatch Logs

  Why it's wrong here

  Amazon CloudWatch Logs is a centralized log storage and monitoring service, but it does not natively capture AWS API activity such as IAM policy changes. It solely ingests and stores logs from sources like applications and AWS services; it cannot generate or record IAM change events on its own. You can configure CloudTrail to deliver events to CloudWatch Logs for real-time alerting, but that only makes CloudWatch Logs a downstream destination, not the audit source itself. Without CloudTrail integration, CloudWatch Logs provides zero visibility into IAM modifications.

• ✗

  Amazon GuardDuty

  Why it's wrong here

  Amazon GuardDuty is a threat detection service that continuously analyzes AWS account activity for malicious behavior, such as unusual API calls or compromised credentials. It does not log every API request or maintain a chronological change history for IAM policies; it only generates findings when it detects suspicious or anomalous activity. Because GuardDuty focuses on identifying threats rather than recording all management events, it cannot satisfy a requirement to audit all changes to IAM policies. Relying on GuardDuty would leave most legitimate policy changes entirely undocumented.

• ✓

  AWS CloudTrail

  Why this is correct

  AWS CloudTrail is the correct choice because it records every management event API call made in your AWS account, including all IAM policy changes such as PutRolePolicy, AttachUserPolicy, DeletePolicy, and CreatePolicy. Each event includes the identity of the caller (user, role, or service), the timestamp, source IP address, request parameters, and response elements, giving you a complete and verifiable audit trail. CloudTrail trails can deliver event logs to an Amazon S3 bucket for long-term retention and optionally to CloudWatch Logs for monitoring. This makes CloudTrail the authoritative service for auditing who changed an IAM policy, when, and what exactly was changed.

• ✗

  AWS Config

  Why it's wrong here

  AWS Config records the configuration state of AWS resources over time and can show that an IAM policy changed from one configuration to another, but it does not capture the API call event or the identity of the principal that made the change. Config's configuration history is resource-centric and lacks the detailed request parameters, source IP, and user context that an audit log requires. While Config can help with compliance and resource drift, it is not designed to provide a full change history of API calls. For a comprehensive audit of IAM policy modifications, you need CloudTrail's event-level detail, not just Config's state-based snapshots.

Go deeper

Related to this question