SCS-C02 Management and Security Governance Practice Question
A security engineer is configuring AWS Config to track changes to security groups in a VPC. The engineer wants to be notified when a security group is modified. Which TWO steps are required to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an SNS topic and subscribe to it to receive notifications when the Config rule triggers.
Options A and D are correct. To monitor security group changes with AWS Config, you need to create an AWS Config rule (option D) that tracks changes to security groups. To receive notifications when the rule triggers, you configure an SNS topic and subscribe to it (option A). Option B is incorrect because AWS CloudTrail logs API calls to security groups, but Config itself monitors resource configuration changes without requiring CloudTrail. Option C is incorrect because Amazon GuardDuty is a threat detection service, not a configuration change monitor. Option E is incorrect because VPC Flow Logs capture network traffic, not configuration changes. The common pitfall is assuming CloudTrail or GuardDuty is necessary, but Config's built-in change tracking suffices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure an SNS topic and subscribe to it to receive notifications when the Config rule triggers.
Why this is correct
SNS can send notifications on Config rule compliance changes.
- ✗
Enable AWS CloudTrail to log security group changes.
Why it's wrong here
CloudTrail is not required for Config notifications.
- ✗
Enable Amazon GuardDuty to detect security group modifications.
Why it's wrong here
Amazon GuardDuty is a threat detection service that identifies suspicious activities and potential compromises, such as unauthorised or anomalous security group modifications. It does not track all configuration changes for compliance or general notification purposes, which is the scenario's requirement. This option is tempting because GuardDuty *does* monitor security groups; it would be correct if the goal was to detect malicious or suspicious changes indicating a security incident, rather than routine modifications.
- ✓
Create an AWS Config rule that monitors security group changes.
Why this is correct
Config rule can track changes to security groups.
- ✗
Enable VPC Flow Logs to capture security group activity.
Why it's wrong here
Flow Logs capture network traffic, not configuration changes.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.