SCS-C02 Security Logging and Monitoring Practice Question
Network Topology
Refer to the exhibit. A security engineer runs the above AWS CLI command to search for CreateKeyPair events in CloudTrail. The command returns no results, but the engineer knows that a key pair was created during that time. What is the most likely reason for the missing events?
⚠ Common exam trap
A common mix-up: candidates assume CloudTrail events are globally accessible or that the default region in the CLI will automatically include events from all regions, leading them to overlook the region-specific nature of the `lookup-events` command.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The command was run in a different region than where the key pair was created.
CloudTrail logs are region-specific. The `aws cloudtrail lookup-events` command without the `--region` flag defaults to the region configured in the AWS CLI (e.g., via `AWS_DEFAULT_REGION` or the CLI profile). If the CreateKeyPair event occurred in a different region, the command would return no results. The engineer must specify the correct region using `--region` to retrieve events from that region.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CreateKeyPair is a data event and not recorded by CloudTrail.
Why it's wrong here
CreateKeyPair is a management/control-plane API call: it provisions an EC2 key pair resource, so CloudTrail classifies it as a management event, not a data event. Data events cover high-volume object-level operations like S3 object access or Lambda invocations. CloudTrail records management events by default, so this explanation is factually incorrect.
- ✓
The command was run in a different region than where the key pair was created.
Why this is correct
CloudTrail trails are scoped to a single Region unless they are organization trails or you have configured aggregation. If the CLI command ran in a different Region than where the key pair was created, the CreateKeyPair event would be delivered to the trail in the creation Region, not the one the engineer queried. The engineer would see nothing, not because the event wasn't recorded, but because they were looking in the wrong regional trail.
- ✗
CloudTrail events are only available after 24 hours.
Why it's wrong here
CloudTrail does not impose a 24-hour delay; management events typically appear in Event history within about 15 minutes of the API call, and while delivery to S3 or CloudWatch Logs can be slightly delayed, it is generally minutes, not a full day. Also, Event history retains 90 days of events. Therefore, a one-day wait is not required to see a key pair creation event.
- ✗
CloudTrail is not enabled for management events.
Why it's wrong here
CloudTrail is enabled by default and records management events automatically; you only need to explicitly enable a trail to get data events or customize delivery. Unless the trail or event data store has been configured to exclude management events, CreateKeyPair will always be logged. So 'CloudTrail is not enabled for management events' is false.
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.