SCS-C02 Threat Detection and Incident Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Amazon GuardDuty

  Why it's wrong here

  GuardDuty analyses VPC flow logs, DNS logs, and CloudTrail events for threat detection, but it does not generate or store its own API call logs; it relies on CloudTrail being enabled separately. It is tempting because it monitors account activity for suspicious behaviour, making it a correct choice for anomaly detection rather than ensuring raw API logging for incident response.

• ✗

  VPC Flow Logs

  Why it's wrong here

  VPC Flow Logs capture metadata about IP traffic within VPCs, such as source/destination addresses and ports, but they do not log API calls made to AWS services like IAM, S3, or Lambda. This fails the requirement because incident response for API-level actions needs a record of who made each call, from which principal, and with what parameters—information VPC Flow Logs never contain. They are tempting because they do log network-level activity, which is useful for diagnosing connectivity issues or detecting anomalous traffic patterns, and would be the correct choice if the requirement were to capture all network flows rather than API operations.

• ✗

  AWS Config

  Why it's wrong here

  AWS Config records resource configuration changes but does not capture API call logs; it lacks the ability to record who made the request, from which source IP, or with what parameters. It is tempting because Config can track changes to resources, which might seem related to auditing, but the requirement is for logging every API call—a task fulfilled by AWS CloudTrail, which records all management and data events.

• ✓

  AWS CloudTrail

  Why this is correct

  AWS CloudTrail is the only service that directly records AWS API activity as first-class audit log events. When enabled, it captures the identity of the caller (IAM user or role), the source IP address, the requested action, request parameters, and the response returned by the service, for both management events and (when configured) data events. These logs can be delivered to Amazon S3 and CloudWatch Logs, and the trail can be multi-region and organization-wide, making CloudTrail the authoritative record of every API call for incident response and governance. Unlike anomaly-detection services such as GuardDuty, CloudTrail does not infer or analyze behavior—it simply logs each call exactly as it occurred.

Go deeper

Related to this question