SCS-C02 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  The user admin created two VPCs, but one was deleted shortly after creation.

  Why this is correct

  Each CreateVpc API call in CloudTrail is recorded with a distinct event ID and returns a unique VPC ID. The current describe-vpcs output shows only one VPC, so one of the two created VPC IDs is absent. That absence indicates a DeleteVpc call (or another deletion mechanism) removed the VPC after creation; CloudTrail's management events would capture that deletion, confirming the lifecycle.

• ✗

  The CloudTrail log is incomplete; both VPCs exist.

  Why it's wrong here

  CloudTrail records all management API calls, but a discrepancy between two CreateVpc events and a single VPC does not mean the log is missing data. If both VPCs were truly present, the describe-vpcs call in the evidence would return both VPC IDs, because there is no pagination or filtering mentioned that would omit one. The most direct explanation is not an incomplete log but a resource that was created and then deleted; assuming incomplete logging ignores the concrete current-state evidence.

• ✗

  Both VPCs were created successfully and still exist.

  Why it's wrong here

  The claim that both VPCs still exist directly contradicts the describe-vpcs result, which lists only one VPC ID. AWS resource IDs are globally unique and immutable, so if the second VPC existed, its VPC ID would have to appear in the current output; it does not. The current state is the source of truth for existence, and the missing ID proves the second VPC is not alive at investigation time.

• ✗

  The user admin only created one VPC; the second event is a duplicate.

  Why it's wrong here

  CloudTrail duplicating a single request would preserve the same event/request ID (or show the same VPC ID) in subsequent entries, but the two events have different event IDs and produce different VPC IDs. Each distinct event ID represents an independent API call, and a successful CreateVpc returns a newly created VPC ID. Thus the evidence shows two actual create operations, not one event being logged twice; the duplicate explanation ignores the unique IDs and the missing VPC.

Go deeper

Related to this question