SCS-C02 Threat Detection and Incident Response Practice Question
A company uses AWS Organizations with multiple accounts. The security team wants to detect and automatically respond to suspicious API calls across all accounts. Which solution is the MOST efficient and scalable?
⚠ Common exam trap
Candidates often confuse AWS Config rules (which evaluate configuration drift) with CloudTrail (which records API activity), or assume that GuardDuty's threat detection includes built-in automated response capabilities, when in fact both require EventBridge for custom automation, making the centralized CloudTrail organization trail plus EventBridge the most efficient and scalable solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable AWS CloudTrail organization trail and use Amazon EventBridge to invoke automated responses
Enabling an AWS CloudTrail organization trail centrally logs all API calls from every account in the AWS Organization into a single Amazon S3 bucket and CloudWatch Logs log group. Amazon EventBridge can then be used to create event rules that match specific suspicious API calls (e.g., IAM DeleteRolePolicy) and automatically invoke target actions like AWS Lambda functions or AWS Systems Manager Automation, providing a scalable, centralized, and efficient detection and response mechanism without per-account management overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Config rules to detect API calls and trigger Lambda functions
Why it's wrong here
AWS Config is designed to assess and record resource configuration changes, not to monitor real-time API calls. Although Config rules can trigger Lambda functions, they receive configuration snapshots and compliance evaluations, not the request context (such as IAM principal, source IP, or request parameters) that CloudTrail provides. Therefore, using Config rules cannot detect API calls as they happen, making it unsuitable for this requirement.
- ✗
Deploy Amazon GuardDuty and use its automated response feature
Why it's wrong here
Amazon GuardDuty is a threat detection service that continuously analyzes VPC Flow Logs, DNS logs, and CloudTrail management events to generate security findings. It does not provide an automated response feature that directly reacts to individual API calls; instead, it emits findings that you must consume via EventBridge or other integrations. The option incorrectly assumes GuardDuty can automatically respond to arbitrary API calls, but its purpose is anomaly detection, not API call automation.
- ✗
Create a CloudTrail trail in each account and aggregate logs via cross-account S3 bucket
Why it's wrong here
While configuring a CloudTrail trail in each account and aggregating logs via a cross-account S3 bucket would capture API events, it is operationally inefficient and error prone. You would need to manage per-account trail configurations, set up complex bucket policies for cross-account writes, and handle log file prefix organization—all without the centralized management that an organization trail provides. This approach also creates a single point of aggregation lag and does not inherently enable automated response, which is why it is not the best solution.
- ✓
Enable AWS CloudTrail organization trail and use Amazon EventBridge to invoke automated responses
Why this is correct
Enabling an AWS CloudTrail organization trail in the management account automatically delivers log files for all accounts in the AWS Organization to a single S3 bucket, centralizing API activity without per-account setup. Amazon EventBridge can then ingest CloudTrail events and use rules to match specific API calls, triggering automated responses via targets like Lambda functions, Step Functions, or SNS topics. This native integration provides real-time, account-wide monitoring and response, making it the recommended and most scalable pattern.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.