SCS-C02 Threat Detection and Incident Response Practice Question

A company uses AWS Organizations with multiple accounts. The security team wants to detect suspicious API activity across all accounts in real time. They have enabled AWS CloudTrail in all accounts and are sending logs to a centralized S3 bucket. However, they are receiving alerts only after a significant delay. What should the security team do to reduce the latency of threat detection?

⚠ Common exam trap

Candidates often assume CloudTrail logs in S3 are the only source for threat detection, overlooking that EventBridge can ingest CloudTrail events in real time without waiting for S3 log delivery.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Set up Amazon EventBridge rules in each account to send specific CloudTrail events to a centralized event bus for immediate processing.

Amazon EventBridge can be configured with rules in each account to forward specific CloudTrail events to a centralized event bus in near real time, bypassing the latency introduced by CloudTrail log delivery to S3 (which can be up to 15 minutes). This allows the security team to process and alert on suspicious API activity immediately as events occur, rather than waiting for log files to be delivered and processed.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Set up Amazon EventBridge rules in each account to send specific CloudTrail events to a centralized event bus for immediate processing.
Why this is correct
This is the correct approach because Amazon EventBridge can ingest CloudTrail API calls in near real time via the default event bus in each account. You can then attach a rule that matches specific CloudTrail event names (e.g., ConsoleLogin, CreateAccessKey) and routes them to a centralized event bus in a monitoring account using an EventBridge cross-account target. This enables immediate, event-driven processing through AWS Lambda, Step Functions, or SNS, and avoids the multi-minute batching delays inherent in CloudTrail S3 delivery.
✗
Enable Amazon GuardDuty in each account and configure it to send findings to a centralized S3 bucket.
Why it's wrong here
Amazon GuardDuty is a threat detection service that analyzes CloudTrail logs, VPC Flow Logs, and DNS logs to produce findings after aggregating and correlating activity patterns. It does not provide real-time, per-API-call alerts, and findings are generated only when suspicious behavior is identified, which can take minutes to hours. Additionally, GuardDuty findings delivered to S3 require an EventBridge/CloudWatch Events rule to forward them, and the destination S3 bucket alone does not enable immediate processing of every CloudTrail event.
✗
Configure CloudTrail to deliver logs to a single S3 bucket and use S3 Event Notifications to trigger a Lambda function.
Why it's wrong here
This option fails because CloudTrail delivers log files to S3 in batches, typically every 5 minutes, so S3 Event Notifications are not generated for individual API calls and cannot provide real-time alerting. Even if you set up Event Notifications to trigger Lambda, you are operating on a complete log file that arrives after a delay, and you must parse the entire file to find events of interest. CloudTrail events are instead designed to be sent to EventBridge in near real time for immediate processing, which is the recommended integration for real-time monitoring.
✗
Use Amazon CloudWatch Logs Insights to query CloudTrail logs across accounts in real time.
Why it's wrong here
Amazon CloudWatch Logs Insights is a query engine for interactively searching and analyzing log data that has already been ingested into CloudWatch Logs, and it is intended for historical analysis, not real-time alerting. While you can query CloudTrail logs stored in a log group, you cannot use Logs Insights itself to trigger actions or stream events in real time; it also does not natively query across multiple accounts without setting up cross-account log data ingestion. For immediate reaction to specific API calls, you need an event-driven service like EventBridge, not a query engine.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Threat Detection and Incident Response Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question