SCS-C02 Security Logging and Monitoring Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Amazon CloudWatch Logs agent

  Why it's wrong here

  The CloudWatch Logs agent is a lightweight daemon installed on EC2 instances to forward local application and OS log files to Amazon CloudWatch Logs. It operates at the instance OS level and captures only what the application writes to disk; it does not sniff network interfaces or record connection-level metadata. Consequently, it cannot be used to detect unusual outbound network connections because it lacks visibility into TCP/UDP packet headers, flow records, or destination IP addresses beyond what an application itself logs.

• ✓

  VPC Flow Logs

  Why this is correct

  VPC Flow Logs are the native AWS feature that captures IP traffic information for network interfaces in a VPC, recording metadata such as source and destination IP addresses, source and destination ports, protocol, and whether the traffic was accepted or rejected. These logs can be published to Amazon CloudWatch Logs or Amazon S3, where they can be analyzed with CloudWatch Logs Insights, Athena, or third-party tools to detect anomalous outbound connections like data exfiltration or beaconing. Because they capture all network flows at the ENI level, they are the appropriate service for monitoring unusual outbound traffic.

• ✗

  Amazon Inspector

  Why it's wrong here

  Amazon Inspector is a vulnerability management and automated security assessment service that scans Amazon EC2 instances and container images for software vulnerabilities, unintended network exposure, and deviations from security best practices. While it can evaluate network reachability between resources, it performs point-in-time assessments rather than continuous network flow capture. It cannot tell you about outbound connections that occur after the assessment or provide real-time visibility into unusual traffic patterns, so it is not the right tool for monitoring outbound network activity.

• ✗

  AWS Config

  Why it's wrong here

  AWS Config provides a detailed inventory of AWS resources and records configuration changes over time, allowing you to evaluate resource compliance against predefined or custom rules. It can track changes to security group rules or network ACLs, but it does not inspect or log actual network traffic traversing the VPC. Since unusual outbound activity is an operational event involving data flows, not a configuration change, AWS Config lacks the telemetry needed to detect such behavior.

Go deeper

Related to this question