SCS-C02 Management and Security Governance Practice Question
A security engineer needs to automate the response to an AWS CloudTrail log event that indicates a potential security threat. Which AWS service would be most appropriate to orchestrate the automated response?
⚠ Common exam trap
SCS-C02 often tests the distinction between 'trigger' and 'orchestrate'—candidates pick EventBridge or Lambda because they initiate the response, but the question asks for the service that coordinates the multi-step workflow, which is Step Functions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Step Functions
AWS Step Functions is a serverless orchestration service that models workflows as state machines, making it ideal for coordinating multi-step, multi-service incident response (e.g., isolate instance → snapshot → notify → create ticket) with retries, branching, and human-approval steps. While Lambda executes individual functions, Step Functions provides the durable orchestration, state tracking, and error handling needed for a reliable automated response. It integrates natively with EventBridge, Lambda, SNS, and security services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Lambda
Why it's wrong here
AWS Lambda runs stateless, single-purpose functions with a maximum execution time of 15 minutes and no native mechanism for sequencing subsequent steps or persisting workflow progress. Building orchestration inside Lambda would force the engineer to hand-code retry loops, state storage, and integrations for every service call, creating unnecessary complexity and making the runbook harder to audit and maintain. Lambda is best used as one of the workers invoked by a Step Functions state machine, not as the workflow engine.
- ✗
Amazon Simple Queue Service (SQS)
Why it's wrong here
Amazon Simple Queue Service (SQS) is a fully managed message queue that decouples event producers from consumers by storing payloads until they are polled and deleted, but it has no concept of workflow state or ordered step execution. It cannot evaluate outputs, branch on conditions, or coordinate multiple follow-up actions, so it could only act as a buffer inside a larger automation pipeline rather than as the orchestration engine. For this reason, SQS alone is the wrong choice for an automated security response runbook.
- ✓
AWS Step Functions
Why this is correct
AWS Step Functions is a serverless workflow orchestration service that models security response runbooks as state machines with explicit states for Lambda invocations, AWS API calls, and human approvals. Its built-in retry, timeout, branching, and parallel-execution semantics let the engineer encode conditional decision points and error handling without custom code. This makes it the appropriate service for automating a coordinated, auditable response to CloudTrail events.
- ✗
Amazon EventBridge
Why it's wrong here
Amazon EventBridge is a serverless event bus that matches CloudTrail events against rules and routes them to targets such as Lambda functions, Step Functions, or other AWS services. While it can trigger a response, its responsibility ends at event filtering and delivery; it provides no built-in workflow primitives like wait states, retries, parallel branches, or human-in-the-loop approvals. EventBridge is thus the entry point for the automation, not the component that implements the multi-step response itself.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.