SCS-C02 Security Logging and Monitoring Practice Question
A company wants to receive real-time notifications when specific API calls are made in their AWS account, such as creating a new IAM user. Which AWS service should be used to trigger a notification based on CloudTrail events?
⚠ Common exam trap
Many exam-takers confuse AWS Config's configuration change detection with real-time event-driven monitoring, but Config operates on a compliance evaluation cycle and does not provide sub-second notification for specific API calls like EventBridge does.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon EventBridge
Amazon EventBridge is the correct service because it can ingest CloudTrail events in near real-time and use event rules to match specific API calls, such as CreateUser, and then route those events to targets like SNS topics to send notifications. EventBridge provides a serverless event bus that directly integrates with CloudTrail, enabling you to react to API activity without custom polling or additional infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config records and evaluates configuration changes of AWS resources, maintaining a history of what a resource looked like and whether it complied with rules. It does not capture the instantaneous API call that triggered the change, and its evaluations are typically run on a periodic schedule or when a configuration change is detected, not as immediate event notifications for every API action. Therefore, it is not suited for real-time alerting on specific AWS API calls.
- ✓
Amazon EventBridge
Why this is correct
Amazon EventBridge is a serverless event bus that can consume AWS service events, including CloudTrail API call events, via a custom or the default event bus. You can define fine-grained event patterns that match specific API actions, resources, or principals, and route matched events to targets like Lambda, SNS, or SQS with low latency. This event-driven mechanism is exactly what enables real-time notifications when a specified AWS API call occurs.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management service that continuously scans workloads for software vulnerabilities and unintended network exposure, such as CVEs or open ports. It performs scans on a schedule or when an assessment is triggered and reports findings, but it does not monitor or react to arbitrary AWS API calls. Because it operates on the workload plane rather than the control plane, it cannot provide real-time notifications about API-level activity.
- ✗
Amazon VPC Flow Logs
Why it's wrong here
Amazon VPC Flow Logs captures IP traffic information for network interfaces in a VPC, including source and destination IPs, ports, protocols, and whether the traffic was accepted or rejected. This is network-level (data plane) metadata, not AWS API-level (control plane) activity, which is recorded by AWS CloudTrail. Flow Logs are also delivered in batches to CloudWatch Logs or S3, so they are not instant event notifications, and they cannot trigger alerts on API calls.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.