SCS-C02 Infrastructure Security Practice Question
A company wants to audit all changes to security group rules in their AWS account. Which AWS service should be used to record these changes?
⚠ Common exam trap
Test-takers frequently confuse AWS Config (which tracks resource configuration state) with CloudTrail (which tracks API activity), leading them to select AWS Config because they think 'audit changes' means monitoring the current state of rules, but the question specifically asks for recording the changes themselves, which requires API-level logging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail.
AWS CloudTrail is the correct service because it records API calls made to the AWS environment, including changes to security group rules via the EC2 AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, AuthorizeSecurityGroupEgress, and RevokeSecurityGroupEgress API actions. These events are captured as management events in CloudTrail, providing a complete audit trail of who made the change, when, from which IP address, and the exact parameters of the rule modification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon CloudWatch Logs.
Why it's wrong here
Amazon CloudWatch Logs is a managed service for storing, monitoring, and querying log files generated by applications, AWS services, and on-premises sources. It does not natively capture AWS API calls or record security group rule modifications; those events are produced only when CloudTrail is configured to deliver its audit logs into CloudWatch Logs. Therefore, CloudWatch Logs is not a direct audit source for security group changes.
- ✓
AWS CloudTrail.
Why this is correct
AWS CloudTrail is the service designed to record AWS API activity, and it captures every security group change as an API event such as AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, AuthorizeSecurityGroupEgress, RevokeSecurityGroupEgress, CreateSecurityGroup, or DeleteSecurityGroup. Each event includes the identity of the caller, the source IP address, the request parameters, and the response elements, giving a complete audit trail of who changed what and when. This makes CloudTrail the appropriate service for auditing all changes to security group rules.
- ✗
VPC Flow Logs.
Why it's wrong here
VPC Flow Logs capture metadata about network IP traffic entering and leaving VPC network interfaces, including source/destination IPs, ports, protocol, packet and byte counts, and an accept/reject action. They do not record security group rule changes or identify the user or API call that modified a rule; a change in SG rules merely alters the pattern of subsequent flow log entries. Thus, VPC Flow Logs are unsuitable for auditing configuration changes.
- ✗
AWS Config.
Why it's wrong here
AWS Config is a configuration management and compliance service that records the state of supported AWS resources, including security group rules, and provides a configuration history and timeline of when each rule was added or removed. It is not the primary audit service for the associated API calls because it does not capture the caller identity, source IP, or the exact API request that produced the change. For a complete audit trail of who made each security group modification, CloudTrail's API event history is required.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.