SCS-C02 CloudWatch Logs Metric Filter Practice Question
A security engineer is configuring AWS CloudWatch Logs to monitor for suspicious activity. They want to create a metric filter that detects when an IAM user calls the `iam:CreateAccessKey` API. The engineer writes the following filter pattern: `{ ($.eventName = "CreateAccessKey") }`. After testing, the filter does not trigger. What is the most likely reason?
⚠ Common exam trap
Candidates often focus on filter pattern syntax or missing fields when the filter doesn't trigger, but the most common cause is misconfiguration of the metric filter's association to the log group. Always verify the log group contains the expected CloudTrail events and that the metric filter is correctly linked.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The metric filter is not associated with the correct log group.
The filter pattern `{ ($.eventName = "CreateAccessKey") }` is syntactically correct and will match any CloudTrail event with eventName CreateAccessKey, regardless of service. The most likely reason the filter does not trigger is that the metric filter is not associated with the correct log group, or the log group does not contain CloudTrail events from IAM. A missing eventSource field does not prevent the filter from working; it would simply match events from any service, which could cause false positives, but not a failure to trigger.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The filter pattern syntax is incorrect; it should use square brackets.
Why it's wrong here
The pattern `{ $.eventName = "CreateAccessKey" }` follows the correct CloudWatch Logs JSON pattern syntax, using space-separated comparisons inside curly braces. Square brackets are not a valid JSON metric filter construct; they are used only for text or delimited log formats such as VPC flow logs. Curly braces with field references are exactly what CloudWatch Logs expects, so a syntax error is not the cause.
- ✓
The metric filter is not associated with the correct log group.
Why this is correct
The most likely cause is that the metric filter is attached to a different log group than the one receiving the CloudTrail CreateAccessKey events. Metric filters evaluate only log data that arrives in the specific log group they are configured on; if the CloudTrail trail streams to another log group in another account or region, or the filter is created under the wrong log group name, the pattern never sees the relevant events. Verify the trail's destination log group and that the filter is assigned there.
- ✗
CloudWatch Logs does not support metric filters for CloudTrail logs.
Why it's wrong here
CloudWatch Logs fully supports metric filters on CloudTrail-delivered log groups; CloudTrail can stream events to CloudWatch Logs, and metric filters are commonly used to monitor these logs for specific API activity. A filter attached to the CloudTrail log group will evaluate the JSON events as they arrive. Therefore, claiming metric filters are unsupported for CloudTrail logs is factually incorrect and cannot explain the missing trigger.
- ✗
The filter pattern does not include the eventSource field, so it might match events from other services.
Why it's wrong here
Omitting eventSource from the pattern makes the match scope broader, not narrower—a CloudTrail CreateAccessKey event has the required eventName and would still satisfy the filter. False positives from other services are a risk, but false negatives are not. If the event is present in the correct log group, the metric should increment, so this pattern issue is not the reason for no trigger.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.