SCS-C02 Security Logging and Monitoring Practice Question
A security analyst wants to receive a notification whenever a new security group is created in their AWS account. Which AWS service should they use to trigger an SNS notification based on the CloudTrail event?
⚠ Common exam trap
Many candidates confuse AWS Config with EventBridge, thinking Config can trigger notifications on API events, but Config only evaluates resource state changes, not real-time API calls, and requires a custom Lambda rule to react to events, whereas EventBridge natively supports CloudTrail event patterns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon EventBridge (CloudWatch Events)
Amazon EventBridge (formerly CloudWatch Events) can monitor CloudTrail API calls in real time and trigger an SNS notification when a specific event, such as CreateSecurityGroup, occurs. By creating a rule that matches the event source and detail type, EventBridge evaluates incoming events and routes matching ones to an SNS topic, enabling the desired notification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat detection service that uses machine learning and anomaly detection to identify malicious activity, unauthorized behavior, and compromised accounts. It does not allow you to monitor for a specific, arbitrary API event (e.g., a particular IAM action) and send a notification. While GuardDuty findings can be forwarded via EventBridge, the service itself is not an event router for CloudTrail API call patterns, so it cannot be used to trigger a notification for every occurrence of a custom event.
- ✗
AWS Config
Why it's wrong here
AWS Config is designed for resource configuration history and compliance evaluation, not for real-time event filtering of API calls. It records configuration changes when a resource changes and evaluates them against rules, sending notifications about changes in configuration state or rule compliance. It does not deliver real-time, event-driven alerts triggered by a specific CloudTrail API event; its notifications are for configuration snapshots and compliance status, not for custom event matching on API calls.
- ✓
Amazon EventBridge (CloudWatch Events)
Why this is correct
Amazon EventBridge (formerly CloudWatch Events) is a serverless event bus that ingests events from AWS services, including CloudTrail API call events, and uses rules to filter and route them to targets such as SNS topics. You can create an event rule with a pattern that matches specific API events (e.g., eventName, eventSource) and immediately invoke an SNS topic to send a notification. This is the correct service for real-time, event-driven alerts based on API activity, as it directly supports the required notification workflow.
- ✗
AWS Lambda
Why it's wrong here
AWS Lambda is a compute service that runs code in response to triggers, but it is not the service that receives, filters, or routes CloudTrail events by default. A Lambda function can be invoked by an EventBridge rule that matches the CloudTrail event, and inside that function you could call SNS; however, without EventBridge in front, Lambda has no native way to subscribe to CloudTrail API events and produce a notification. Therefore, Lambda alone cannot meet the requirement; it would be just the compute target, not the triggering mechanism.
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.