SCS-C02 Security Logging and Monitoring Practice Question
A company wants to monitor AWS API calls for suspicious activity and automatically remediate by revoking IAM roles in real time. Which combination of services should be used?
⚠ Common exam trap
Many exam-takers confuse AWS Config's compliance evaluation with real-time event-driven remediation, or assume GuardDuty alone provides automated remediation, when in fact both require CloudWatch Events and Lambda for the actual automated response.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon CloudWatch Events and AWS Lambda
The combination of Amazon CloudWatch Events and AWS Lambda enables real-time monitoring and automated remediation of AWS API calls. CloudWatch Events can capture API calls from AWS CloudTrail (or other sources) and trigger a Lambda function to revoke IAM roles based on suspicious activity patterns, providing the required real-time response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudTrail and Amazon Inspector
Why it's wrong here
AWS CloudTrail records API activity, but Amazon Inspector is a vulnerability management service that scans EC2 instances for software vulnerabilities and unintended network exposure. Inspector does not analyze CloudTrail logs, correlate API calls, or provide real-time alerts about suspicious user behavior, so this pairing lacks the event-driven detection and response capability required.
- ✗
AWS CloudTrail and AWS Config
Why it's wrong here
While AWS CloudTrail provides the audit trail of API calls, AWS Config is designed to assess resource configuration compliance, not to monitor or react to patterns of API activity. Config rules evaluate desired configuration states and can trigger auto-remediation, but they do not consume API call history to identify anomalous actions, making this combination unsuitable for real-time threat monitoring.
- ✗
Amazon GuardDuty and AWS Config
Why it's wrong here
Amazon GuardDuty does generate findings for suspicious API activity using threat intelligence and anomaly detection, but it only produces findings—it does not automatically take remediation actions. AWS Config similarly focuses on configuration compliance and cannot directly execute responses to GuardDuty findings; a typical architecture pairs GuardDuty with CloudWatch Events and Lambda to achieve automated revocation of credentials.
- ✓
Amazon CloudWatch Events and AWS Lambda
Why this is correct
By creating a CloudWatch Events rule with an event pattern matching specific AWS API calls recorded by CloudTrail, organizations can invoke a Lambda function in real time to conduct security actions such as revoking IAM roles, deleting access keys, or restricting permissions. This event-driven model delivers immediate, automated remediation of suspicious API activity, satisfying the requirement.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.