SCS-C02 Security Logging and Monitoring Practice Question

A DevOps engineer needs to monitor failed SSH login attempts to Amazon EC2 instances. Which AWS service should the engineer use to collect and analyze the login events?

⚠ Common exam trap

Candidates often confuse AWS CloudTrail (which logs AWS API calls) with OS-level auditing, mistakenly thinking CloudTrail captures guest OS login events, when in fact CloudTrail only records control-plane actions and never sees inside the instance's operating system.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Amazon CloudWatch Logs

Amazon CloudWatch Logs is the correct service because it can ingest, monitor, and analyze log data from EC2 instances, including SSH authentication logs (e.g., /var/log/secure or /var/log/auth.log). By installing the CloudWatch Logs agent on the EC2 instance, the engineer can stream these log events to CloudWatch Logs, where they can be searched, visualized, and used to trigger alarms on failed SSH attempts. AWS Config tracks resource configuration changes, not OS-level login events; CloudTrail records AWS API calls, not guest OS logs; and VPC Flow Logs capture network traffic metadata, not application or authentication logs.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
AWS Config
Why it's wrong here
AWS Config is a resource inventory and compliance service that evaluates infrastructure configuration, such as security group rules or IAM role attachments, against desired policies. It does not deploy agents inside the guest OS and therefore has no visibility into /var/log/auth.log or /var/log/secure, where sshd writes failed authentication events. Since OS-level login failures are not a change to an AWS resource configuration, Config cannot monitor them.
✓
Amazon CloudWatch Logs
Why this is correct
Amazon CloudWatch Logs is the correct choice because the CloudWatch agent (or the legacy Logs agent) can be installed on an EC2 instance to tail local system logs, including /var/log/auth.log on Amazon Linux or /var/log/secure on RHEL/CentOS. Once collected, you can define a metric filter to match patterns such as 'Failed password' or 'Connection refused' that sshd emits on failed attempts, and then trigger alarms based on those metrics. This directly captures the OS-level authentication events needed to monitor failed SSH logins.
✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail records API activity made on the AWS control plane, such as when a user calls ec2:RunInstances or an IAM role assumes a role. It has no agent inside the EC2 guest and cannot observe SSH daemon behaviors like password rejection or key exchange failures. Because failed SSH attempts are operating system events rather than AWS API calls, CloudTrail provides none of the required visibility.
✗
VPC Flow Logs
Why it's wrong here
VPC Flow Logs capture network-level metadata about IP traffic traversing the VPC, including source/destination IP addresses, ports, protocols, and the number of packets and bytes, but they do not include packet payloads or application-level content. A failed SSH login attempt, for example a wrong password or an expired key, leaves no distinct footprint in a flow log; successful and unsuccessful attempts both generate identical-looking TCP traffic to port 22. Therefore, flow logs cannot distinguish authentication failures and are unsuitable for this monitoring task.

Go deeper

SCS-C02 Security Logging and Monitoring Practice Question

Why each option matters

Option-by-option breakdown

Related to this question