SCS-C02 Security Logging and Monitoring Practice Question
A security engineer is investigating a potential security incident. The engineer has enabled CloudTrail and VPC Flow Logs. Which THREE pieces of information can the engineer obtain from CloudTrail logs that are NOT available in VPC Flow Logs? (Choose three.)
⚠ Common exam trap
Watch out — candidates often assume CloudTrail logs contain the full request payload (Option A) because they confuse CloudTrail with AWS Config or data-plane logging, but CloudTrail explicitly excludes payload data to avoid storing sensitive information.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The AWS Region where the API call was made.
CloudTrail logs capture management-plane API calls, including the AWS Region where the call was made (via the 'awsRegion' field). VPC Flow Logs only capture network-level metadata (IP addresses, ports, protocols) and have no visibility into the AWS Region of an API call because they operate at Layer 3/4 of the OSI model and do not log control-plane events. Therefore, the Region information is uniquely available in CloudTrail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The payload of the API request.
Why it's wrong here
CloudTrail logs are event-based and capture metadata about API activity—such as the action name, principal, timestamp, and request/response elements—but they never capture the raw request payload or body. VPC Flow Logs similarly only record network-level headers, not application-level content, so the payload of the API request is unavailable in either source.
- ✓
The AWS Region where the API call was made.
Why this is correct
The AWS Region where the API call was made is a definitive field in CloudTrail's event history (the awsRegion attribute), whereas VPC Flow Logs are tied to a specific VPC and only describe traffic within that VPC's region. An API call's endpoint region may differ from the region of the VPC through which the traffic flows, so only CloudTrail provides this region information.
- ✗
The destination IP address and port of the network traffic.
Why it's wrong here
Destination IP and port are core fields of the VPC Flow Log's 5-tuple (source IP/port, destination IP/port, protocol) and describe the actual network connection. CloudTrail does not record the destination IP or port of the API request; it only logs the source IP and user agent at the control-plane level. Thus this information comes solely from VPC Flow Logs.
- ✓
The IAM user or role that performed the API call.
Why this is correct
CloudTrail is the definitive source for identity in API calls—the userIdentity object captures the IAM user, role, federated identity, or assumed-role session that made the request. VPC Flow Logs operate at the network layer and contain no IAM identity information; they only see IP addresses and ports. Therefore this detail is obtainable only from CloudTrail.
- ✓
The source IP address of the API call.
Why this is correct
CloudTrail records the sourceIPAddress field for every API request, which is the IP address of the client as observed by the AWS endpoint. VPC Flow Logs also capture source IP addresses of network packets, but that IP is the packet's origin within the VPC and could be a NAT gateway, proxy, or intermediate resource rather than the API caller. So while both logs can show IP addresses, CloudTrail specifically provides the API call's source IP.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.