SCS-C02 Threat Detection and Incident Response Practice Question
A company uses AWS CloudTrail to log API calls in all accounts. The security team wants to be notified immediately when an IAM user creates a new access key for another user. Which combination of services should the team use?
⚠ Common exam trap
It's easy for candidates to confuse AWS Config (which is reactive and compliance-focused) with CloudTrail (which is event-driven and real-time), leading them to choose Option A instead of the correct CloudTrail + CloudWatch Logs + SNS combination.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail, Amazon CloudWatch Logs, and Amazon Simple Notification Service (SNS).
It uses CloudTrail to capture the CreateAccessKey API call, sends those logs to CloudWatch Logs, and then triggers a CloudWatch alarm that publishes to an SNS topic for immediate notification. This combination provides real-time alerting on the specific IAM event without requiring additional services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config and Amazon Simple Email Service (SES).
Why it's wrong here
AWS Config records configuration changes and can evaluate resources against rules, but it does not provide real-time alerting on specific API calls; its compliance notifications are typically delivered through SNS topics, not directly to SES. Moreover, SES is an email-sending service, not a notification or alerting pipeline, so it cannot trigger on IAM access key creation events. Since the requirement is to be notified when a CreateAccessKey API call occurs, you need CloudTrail log delivery to CloudWatch Logs with a metric filter and alarm, not Config and SES.
- ✗
Amazon GuardDuty and Amazon Simple Notification Service (SNS).
Why it's wrong here
Amazon GuardDuty continuously analyzes VPC Flow Logs, DNS logs, and CloudTrail management events to identify threats, but it does not specifically monitor or alert on routine IAM user creation of access keys; its findings are for malicious activity such as credential compromise or crypto mining. SNS can certainly publish notifications, but to use SNS for this IAM event you'd first need CloudTrail to capture the event and a CloudWatch Logs metric filter to trigger an alarm. Pairing GuardDuty with SNS alone leaves the detection of the specific API call unresolved.
- ✗
Amazon Macie and AWS Lambda.
Why it's wrong here
Amazon Macie is a data security service that uses machine learning to discover, classify, and protect sensitive data in S3 buckets; it has no visibility into IAM user actions like access key creation. AWS Lambda could be used to react to events, but without a source of the IAM API calls—such as CloudTrail streamed to CloudWatch Logs or an EventBridge rule—the function has nothing to consume. This option lacks the event logging and alerting components needed to meet the requirement, so it is incorrect.
- ✓
AWS CloudTrail, Amazon CloudWatch Logs, and Amazon Simple Notification Service (SNS).
Why this is correct
AWS CloudTrail captures management events, including the CreateAccessKey API call, and can be configured to deliver those events to Amazon CloudWatch Logs. In CloudWatch Logs, a metric filter with a pattern like 'eventName: CreateAccessKey' creates a custom metric; a CloudWatch alarm on that metric then publishes a message to an SNS topic, which sends email or SMS notifications. This combination provides real-time alerting for the exact IAM event, making it the correct architecture.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.