SCS-C02 Security Logging and Monitoring Practice Question
A company needs to monitor its AWS environment for compliance with the CIS AWS Foundations Benchmark. The security team wants to automatically check for non-compliant resources and receive reports. Which THREE services should be used together to meet these requirements? (Choose THREE.)
⚠ Common exam trap
The trap is that candidates often confuse threat-detection services (GuardDuty, Detective, Macie) with compliance monitoring services. Security Hub is the central place for aggregating and reporting on compliance standards like CIS, and AWS Config provides the underlying rule evaluation engine. GuardDuty findings do not check CIS controls or produce CIS compliance reports.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Security Hub
AWS Security Hub (B) is correct because it natively supports the CIS AWS Foundations Benchmark as a security standard, aggregates findings from integrated services, and generates compliance scores and reports against that benchmark. AWS Config (C) is correct because it provides configuration recording and managed/custom rules that evaluate resource compliance, and Security Hub's CIS standard relies on AWS Config rules to assess many controls. Amazon GuardDuty (D) is not required for CIS AWS Foundations Benchmark compliance checking or reporting; it is a threat-detection service whose findings can be viewed in Security Hub but does not evaluate CIS controls. Amazon Detective (A) is used for investigating and visualizing security findings after they occur, and Amazon Macie (E) discovers and classifies sensitive data in S3; neither is part of the CIS compliance-checking and reporting workflow.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon Detective
Why it's wrong here
Amazon Detective is a threat investigation service that analyzes security findings to identify root causes, but it does not perform automated compliance checks against the CIS benchmark.
- ✓
AWS Security Hub
Why this is correct
Correct. Security Hub is the central hub for compliance status, aggregating findings from AWS Config and GuardDuty, and providing reports on CIS benchmark compliance.
- ✓
AWS Config
Why this is correct
Correct. AWS Config provides the underlying rule evaluation engine for CIS benchmark checks, identifying non-compliant resources.
- ✗
Amazon GuardDuty
Why it's wrong here
Correct. GuardDuty detects security threats that may indicate non-compliance or vulnerabilities, and its findings are integrated into Security Hub for a comprehensive compliance view.
- ✗
Amazon Macie
Why it's wrong here
Macie discovers sensitive data, not compliance checks.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.