SCS-C02 Security Logging and Monitoring Practice Question
A security engineer needs to ensure that all API calls made in an AWS account are captured and retained for auditing purposes. The engineer must be able to query the logs for specific user activity over the past 90 days. Which AWS service should the engineer use to meet these requirements?
⚠ Common exam trap
Many exam-takers confuse CloudTrail's default 90-day Event History with the need to create a trail and store logs in S3, but the question explicitly states 'captured and retained for auditing purposes' and 'query the logs for specific user activity over the past 90 days,' which is exactly what the built-in Event History provides without additional configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity, source IP, request parameters, and response elements. By default, CloudTrail stores event history for the last 90 days, which can be queried via the Event History console or API, meeting the requirement to query logs for specific user activity over the past 90 days without additional configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is the native API auditing service: it records user activity and API calls across the account as CloudTrail events, capturing the identity, source IP, timestamp, request parameters, and response elements. These events can be delivered to Amazon S3 for long-term retention and queried with Athena, or sent to CloudWatch Logs for alerting. To fully meet an "all API calls" requirement, both management and data events must be enabled across all regions.
- ✗
Amazon VPC Flow Logs
Why it's wrong here
Amazon VPC Flow Logs capture metadata about network traffic at the elastic network interface level—source and destination IPs, ports, protocols, packets, and bytes—for both accepted and rejected flows. They operate at the network layer and do not include the API action name, caller identity, request parameters, or response details. As a result, VPC Flow Logs cannot be used to audit who or what performed API calls to AWS.
- ✗
Amazon CloudWatch Logs
Why it's wrong here
Amazon CloudWatch Logs is a centralized log store and monitoring service for application, service, and AWS log sources; it does not itself detect or record API calls. It can receive CloudTrail events only when CloudTrail is configured to deliver them, and it can then create metric filters or alarms. Without CloudTrail as the source, CloudWatch Logs has no intrinsic capability to capture API activity, so it is not the service that ensures all API calls are recorded.
- ✗
AWS Config
Why it's wrong here
AWS Config continuously records and assesses resource configuration changes and relationships, maintaining a timeline of what a resource looked like at each point in time. It applies rules to evaluate compliance, but it does not capture the API request or response data, the IAM principal who performed an action, or the exact API call. Its configuration history reflects the results of changes, not an auditable log of every API call made.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.