SCS-C02 Security Logging and Monitoring Practice Question
A security engineer is investigating a potential security incident and needs to determine if an EC2 instance was launched with a specific AMI ID. Which AWS log should be examined?
⚠ Common exam trap
Test-takers frequently confuse AWS Config (which shows resource configuration history) with CloudTrail (which logs API calls), leading them to choose AWS Config timeline even though it does not capture the AMI ID parameter from the launch request.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail records all API calls made within an AWS account, including the RunInstances API call that launches an EC2 instance. The CloudTrail event for RunInstances contains the AMI ID in the request parameters, allowing you to determine if a specific AMI was used. This makes CloudTrail the correct log to examine for this investigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config timeline
Why it's wrong here
AWS Config records resource configuration changes over time as configuration items, so its timeline can show when an EC2 instance's attributes (instance type, security groups, tags) changed. However, it is not a point-in-time API audit log, and it does not directly surface the RunInstances request parameters such as the AMI ID along with the IAM principal, source IP, and timestamp of the launch action. A configuration timeline is useful for tracking drift, not for reconstructing the specific API call that launched the instance.
- ✗
VPC Flow Logs
Why it's wrong here
VPC Flow Logs capture metadata about network traffic—source and destination IP addresses, ports, protocols, packet and byte counts—on the VPC's network interfaces. They are entirely layer 3/4 telemetry and contain no information about EC2 instance launch APIs, the AMI ID, or the identity of the user who made the RunInstances call. Even if the suspicious instance made network connections, flow logs cannot identify the chosen AMI.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is the correct source because it records the RunInstances API call as a management event, and the event's requestParameters field contains the ImageId (AMI ID) as well as instance type, key name, security groups, and subnet. The event's userIdentity and sourceIPAddress/vpcEndpoint fields identify exactly which IAM principal or role launched the instance and from where. CloudTrail EventHistory is normally searchable for 90 days; for older incidents, you must query the delivery to an S3 bucket or CloudTrail Lake.
- ✗
Amazon CloudWatch Logs (EC2 agent logs)
Why it's wrong here
Amazon CloudWatch Logs with the unified CloudWatch agent collects log streams from the EC2 instance's guest OS, such as application logs, syslog, or custom text files. These logs only begin once the OS is booted and cannot reveal the API-level launch request, the AMI ID, or the IAM user who executed RunInstances. At best, the agent's logs might show OS boot or provisioning artifacts, but they do not provide an authoritative audit record of the launch action.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.