SCS-C02 Threat Detection and Incident Response Practice Question
A company uses AWS CloudTrail to log all API activity. The security team wants to ensure that any changes to CloudTrail configuration (e.g., disabling the trail, deleting the trail, modifying the log delivery) are detected immediately. They have created a CloudWatch Events rule to capture the event 'StopLogging' and send an SNS notification. During testing, the team stops the trail and does not receive the notification. The CloudWatch Events rule is configured with the correct event pattern. What should the team check?
⚠ Common exam trap
Many exam-takers assume the event pattern matching is the only requirement for delivery, overlooking the IAM permissions needed for the CloudWatch Events rule to invoke the SNS target.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the IAM role associated with the CloudWatch Events rule to ensure it has permissions to publish to the SNS topic.
CloudWatch Events rules require an IAM role with permissions to invoke the target (e.g., publish to SNS). Even if the event pattern matches and the SNS topic exists, without a properly configured IAM role that grants `sns:Publish` to the CloudWatch Events service, the rule cannot deliver the notification. This is a common misconfiguration that causes silent failures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Verify that the CloudTrail trail is logging management events.
Why it's wrong here
CloudTrail trails are configured to log management events by default, so this option is almost certainly not the root cause. Even if the trail were missing read/write management events, that would explain why CloudTrail has no log entries, but it would not explain why the CloudWatch Events rule fires yet no SNS notification is delivered. The rule is already triggering, so the issue is downstream in the event delivery path, not in the upstream audit logging source.
- ✗
Ensure that the event pattern includes the correct source and detail-type.
Why it's wrong here
If the event pattern were incorrect, the rule would simply not match the API call and would not invoke the target. The problem states the rule is firing, which means the event pattern already matched the incoming event's source and detail-type. Therefore, adjusting the pattern would be redundant and would not fix the missing SNS notification.
- ✗
Confirm that the SNS topic subscription is confirmed.
Why it's wrong here
SNS subscription confirmation is only required for protocols that need a confirmation endpoint, such as email, HTTP, or SMS. For Lambda, SQS, or other AWS service integrations, the subscription is automatically confirmed. More importantly, the CloudWatch Events rule publishes directly to the SNS topic, not to a specific subscription, so the confirmation state of individual subscriptions is irrelevant to whether the rule can push a message to the topic.
- ✓
Check the IAM role associated with the CloudWatch Events rule to ensure it has permissions to publish to the SNS topic.
Why this is correct
CloudWatch Events rules that target an SNS topic must assume an IAM role that grants sns:Publish on that topic's ARN. Without that permission, the rule fails at execution time with an AccessDenied error, even though the event pattern matched and the rule appears to have fired. The correct fix is to verify the role's trust policy allows events.amazonaws.com to assume it and that the attached policy includes the exact sns:Publish action for the target topic.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.