SCS-C02 Threat Detection and Incident Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  AWS CloudTrail

  Why this is correct

  AWS CloudTrail is the authoritative audit trail for AWS API activity, recording every management and data event with the invoking IAM identity, source IP address, user agent, and timestamp. For a credential investigation, CloudTrail lets you reconstruct exactly which programmatic or console actions were performed with the suspected credentials, including failed authentication attempts and sign-in events from the us-east-1 region. It can also be configured to deliver those immutable logs to S3 for long-term forensics and to CloudWatch Logs for real-time alerting, making it the primary service to answer 'who did what, when, and from where'.

• ✗

  VPC Flow Logs

  Why it's wrong here

  VPC Flow Logs capture metadata about IP traffic passing through VPC network interfaces, such as source and destination IP addresses, ports, protocol, and bytes transferred. They do not record the API request's content, the authenticated IAM identity, or the specific AWS operation performed, so they cannot directly reveal which credentials were used or what actions were attempted. Even if a malicious credential is used, Flow Logs might only show a network connection to an AWS API endpoint, offering no forensic detail about the call itself.

• ✗

  AWS Trusted Advisor

  Why it's wrong here

  AWS Trusted Advisor provides point-in-time assessments and recommendations across cost optimization, performance, security, and fault tolerance, using checks such as leaked IAM access keys or overly permissive security groups. It does not maintain a historical log of API calls or user authentication events, so it cannot be used to trace how a credential was used or when it may have been compromised. In an investigation, Trusted Advisor can flag that a credential is publicly exposed or that IAM key rotation is overdue, but it offers no event-level audit data.

• ✗

  Amazon CloudWatch Logs

  Why it's wrong here

  Amazon CloudWatch Logs is a centralized log storage and analysis service, but it does not natively ingest or generate AWS API call records. To get API activity into CloudWatch Logs, a security engineer must explicitly configure AWS CloudTrail to deliver management and data events to a CloudWatch Logs log group, or have applications ship their own logs via an agent — without that setup, no credential usage history exists there. While useful for monitoring or searching CloudTrail-delivered events, it is only a downstream consumer and cannot serve as the primary forensic source for investigating credential misuse.

Go deeper

Related to this question