SCS-C02 Threat Detection and Incident Response Practice Question
A company's AWS Lambda function that processes sensitive data is triggering unexpectedly. The security team wants to investigate using AWS CloudTrail. What should they look for?
⚠ Common exam trap
Watch out — candidates often confuse configuration or creation events with invocation events, mistakenly thinking that `UpdateFunctionConfiguration` or `CreateFunction` would show who triggered the function, when in fact only `Invoke` events capture the actual execution requests.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
`Invoke` events in CloudTrail from the Lambda service.
`Invoke` events in CloudTrail record every invocation of a Lambda function, including the source (e.g., AWS service, SDK, or console) and the identity that triggered it. By analyzing these events, the security team can identify unexpected triggers, such as unauthorized IAM users or roles invoking the function, or anomalous invocation patterns that indicate a potential security issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
`UpdateFunctionConfiguration` events in CloudTrail from the Lambda service.
Why it's wrong here
UpdateFunctionConfiguration is a Lambda management-plane operation that records changes to a function's runtime, memory, timeout, or environment variables. It has nothing to do with the actual processing of sensitive data, because it is emitted only when a configuration update is submitted, not when the function is called. Consequently, it cannot provide evidence of which principals invoked the function or how many times data was processed.
- ✗
`CreateFunction` events in CloudTrail from the Lambda service.
Why it's wrong here
CreateFunction is an event that appears once in CloudTrail when the Lambda function is initially deployed, whether through the console, CLI, or infrastructure-as-code. It is a control-plane action that establishes the function's code and role, but it never fires during subsequent executions. Therefore, it is useless for auditing the runtime access to sensitive data because it does not indicate any invocations.
- ✓
`Invoke` events in CloudTrail from the Lambda service.
Why this is correct
Invoke events are the Lambda data-plane records logged to CloudTrail every time the function is actually called; each event captures the function name, qualifier, timestamp, request parameters, and invoking principal. Enabling data events on Lambda in a CloudTrail trail is what makes these entries appear, and they are precisely what an auditor needs to see who invoked the function and when. This is why Invoke is the correct way to audit that sensitive-data processing occurred.
- ✗
`PutSubscriptionFilter` events in CloudTrail from CloudWatch Logs.
Why it's wrong here
PutSubscriptionFilter is an API call made to CloudWatch Logs to route log streams to a destination such as Lambda or Kinesis, and it is recorded as a CloudWatch Logs control-plane event. It is a one-time configuration action that enables log delivery, but it does not reflect each separate invocation or the contents processed by the Lambda function. Thus it cannot serve as an audit record of sensitive data being processed, only as evidence that log subscription was set up.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.