SCS-C02 Threat Detection and Incident Response Practice Question

A security engineer needs to detect suspicious API calls across multiple AWS accounts. The engineer has enabled AWS CloudTrail in each account and is sending logs to a central S3 bucket. Which additional step should the engineer take to analyze the logs for potential threats?

⚠ Common exam trap

Watch out — candidates often confuse VPC Flow Logs (network traffic) with CloudTrail logs (API activity), or think that Config rules or Trusted Advisor can detect suspicious API calls, when in fact GuardDuty is the dedicated threat detection service for this purpose.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable Amazon GuardDuty in each account.

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including suspicious API calls, by analyzing CloudTrail management and data events, VPC Flow Logs, and DNS logs. By enabling GuardDuty in each account, the security engineer can automatically detect potential threats across all accounts without manual log analysis. This directly addresses the need to analyze CloudTrail logs for suspicious API calls at scale.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Enable AWS Config rules to monitor CloudTrail configuration.
Why it's wrong here
AWS Config records resource configuration history and can run managed rules such as cloudtrail-enabled to verify a trail exists, but it does not analyze the contents of CloudTrail events. It evaluates settings and compliance drift, not whether an API call is malicious or anomalous. Therefore it cannot detect suspicious API activity.
✗
Enable AWS Trusted Advisor in the management account.
Why it's wrong here
AWS Trusted Advisor provides periodic recommendations across cost, performance, and security categories, including checks like MFA on the root account and IAM key rotation. It is an optimization dashboard, not a security event analysis engine, and its checks run infrequently from the management account rather than continuously processing CloudTrail logs. As a result, it cannot identify or alert on suspicious API calls.
✓
Enable Amazon GuardDuty in each account.
Why this is correct
Amazon GuardDuty is a continuous, intelligent threat detection service that ingests CloudTrail management events, VPC Flow Logs, and DNS query logs to detect suspicious API calls. It builds a baseline of normal account behavior and uses anomaly detection, machine learning, and threat intelligence to identify actions such as unusual logins, IAM privilege escalation, or resource exposure. Enabling it in each account gives complete coverage of API activity across the organization.
✗
Enable VPC Flow Logs in each account.
Why it's wrong here
VPC Flow Logs capture IP traffic metadata—source and destination addresses, ports, protocol, and packet counts—at the network interface level. They do not log the application-layer API requests made to AWS services, so they cannot reveal actions like RunInstances or DeleteBucket. Flow logs help troubleshoot network connectivity and analyze traffic patterns, but they are not a substitute for CloudTrail-based API threat detection.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Threat Detection and Incident Response Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question