SCS-C02 Threat Detection and Incident Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use AWS Config rules with an aggregator in the management account to evaluate CloudTrail configuration across all accounts.

  Why this is correct

  AWS Config rules can run managed or custom rules against the configuration of CloudTrail trails, and an aggregator in the management account lets you view compliance results from all member accounts in a single dashboard. When a trail is misconfigured or deleted, the rule evaluates the change and can trigger an Amazon EventBridge event to notify administrators. This is the only option that provides continuous, native, multi-account governance without writing custom monitoring code or relying on external scheduling.

• ✗

  Enable CloudTrail Insights in all accounts to detect unusual activity.

  Why it's wrong here

  CloudTrail Insights analyzes the event history of the trail to identify unusual API activity, such as IAM role chaining, unusually high error rates, or resource limit exceedances. It does not evaluate the configuration of the trail itself, so it cannot detect whether the trail is disabled, has an insecure log file validation setting, or is missing from a required Region. Enabling Insights adds detection capability for anomalous behavior but leaves configuration compliance gaps unresolved.

• ✗

  Enable IAM Access Analyzer in each account to monitor CloudTrail changes.

  Why it's wrong here

  IAM Access Analyzer is designed to identify resources shared with external principals by analyzing resource-based policies (e.g., S3 bucket policies, KMS key policies, IAM roles). It has no logic to inspect the configuration of CloudTrail trails, such as whether the trail is logging to the correct S3 bucket, has log validation enabled, or is applying the correct management event selectors. Using it to monitor CloudTrail changes would be a fundamental mismatch of the service's intended purpose, providing no relevant compliance signal.

• ✗

  Create a Lambda function that periodically checks CloudTrail status in each account via the API.

  Why it's wrong here

  A Lambda function that periodically calls the GetTrailStatus and GetTrail APIs can check trail existence and logging status, but this approach requires you to build custom code, manage IAM roles across accounts, and schedule invocations with CloudWatch Events; it also does not provide a persistent compliance record or automatic evaluation when configuration changes occur. AWS Config provides the same checks natively with built-in rules, centralized aggregation, and point-in-time compliance history, making the Lambda solution higher effort and less reliable for continuous monitoring.

Go deeper

Related to this question