SCS-C02 Threat Detection and Incident Response Practice Question
A security engineer needs to detect and respond to potential credential theft where an IAM user's access key is being used from an unusual geographic location. Which AWS service should be used to generate alerts based on this anomaly?
⚠ Common exam trap
Candidates often confuse AWS CloudTrail's logging capability with active threat detection, assuming that CloudTrail alone can generate alerts for geographic anomalies, when in reality it only provides raw logs that require additional analysis services like GuardDuty or custom solutions to detect and alert on such patterns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon GuardDuty
Amazon GuardDuty is the correct choice because it is a threat detection service that uses machine learning and integrated threat intelligence to identify anomalous behavior, such as an IAM access key being used from an unusual geographic location. It specifically analyzes CloudTrail management and data events, VPC flow logs, and DNS logs to detect credential theft patterns like a new geolocation or an impossible travel scenario, and can trigger alerts via Amazon EventBridge or SNS for automated response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS IAM Access Analyzer
Why it's wrong here
AWS IAM Access Analyzer is designed to analyze resource policies (like S3 bucket policies or IAM roles) and identify when they grant access to principals outside your account or to external entities. It does not inspect user authentication events, API call patterns, or attempt to detect suspicious behavioral indicators such as anomalous logins or credential misuse. Therefore, while useful for reducing unintended policy-based exposure, it cannot serve as a threat detection service for active user behavior.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail is the foundational service for recording API activity in your account, capturing who made the call, when, from where, and with what parameters. However, CloudTrail itself is purely a logging service; it performs no real-time anomaly detection, correlation, or alerting on the recorded events, nor does it apply machine learning to identify indicators of compromise. To detect threats from these logs, you must integrate CloudTrail with separate analytics or detection services, so it does not natively provide threat detection capabilities.
- ✓
Amazon GuardDuty
Why this is correct
Amazon GuardDuty is a continuous threat detection service that consumes CloudTrail management and data events, VPC flow logs, and DNS logs, then applies anomaly detection and threat intelligence to identify suspicious API activity and credential compromise. It uses machine learning to baseline normal behavior and can trigger findings for events like unusual login patterns, account compromises, or API calls made from known malicious IPs. This directly satisfies the requirement to detect and respond to potential behavioral threats, making it the correct choice.
- ✗
AWS Config
Why it's wrong here
AWS Config is a configuration management and compliance service that assesses resource configurations against desired policies, records configuration changes, and can trigger rules to evaluate whether resources violate standards. It does not analyze API call sequences, user identities, authentication behavior, or the intent behind actions; it only evaluates the state and changes of AWS resources. Consequently, it cannot detect suspicious user behavior such as credential compromise or anomalous API activity, making it unsuitable for this security detection use case.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.