SCS-C02 Threat Detection and Incident Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Amazon GuardDuty

  Why it's wrong here

  Amazon GuardDuty is a continuous security monitoring service that uses machine learning, anomaly detection, and threat intelligence to identify malicious activity and unauthorized behavior. While it can detect many types of threats from CloudTrail and VPC Flow Logs, it does not allow you to define custom, real-time alert rules for every specific API call pattern. Its focus is on known threat signatures and behavioral anomalies, not on providing granular, per-API-call alerting that an engineer might need for suspicious activity.

• ✓

  AWS CloudTrail combined with Amazon CloudWatch Events

  Why this is correct

  AWS CloudTrail records every API call made to AWS services, capturing details such as the identity, time, source IP, and request parameters. By sending these event logs to Amazon CloudWatch Events (or Amazon EventBridge), you can create custom rules to match specific API activity, such as unusual calls or attempts from unexpected regions, and trigger alerts via SNS or AWS Lambda. This combination gives you direct, real-time, and customizable detection and alerting on the API calls themselves, making it the correct choice.

• ✗

  AWS Config

  Why it's wrong here

  AWS Config is designed to assess, audit, and evaluate the configurations of AWS resources against desired policies and compliance standards. It records resource configuration changes and can trigger rules based on those configurations, but it does not capture or analyze the API calls that caused those changes. Because the requirement is to detect suspicious API activity, AWS Config lacks the necessary visibility into the actual API call event stream and cannot generate alerts for suspicious API actions.

• ✗

  VPC Flow Logs

  Why it's wrong here

  VPC Flow Logs capture metadata about IP traffic entering and leaving network interfaces in a VPC, including source and destination IP addresses, ports, protocols, and packet/byte counts. They are invaluable for analyzing network-level behavior, such as unusual traffic patterns or potential network reconnaissance, but they do not log AWS API calls or identify user actions. Since the security engineer needs to detect suspicious API activity rather than network traffic, VPC Flow Logs are unsuitable for this specific requirement.

Go deeper

Related to this question