SCS-C02 Threat Detection and Incident Response Practice Question
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/MyFunction:*"
}
]
}The above IAM policy is attached to an AWS Lambda function. The function is failing to write logs to CloudWatch Logs. What is the likely cause?
⚠ Common exam trap
The trap here is that candidates focus on the actions (e.g., missing `logs:DescribeLogGroups`) rather than the resource ARN, which must include the log group itself (not just log streams) for the initial log group creation or access check.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The resource ARN does not include the log group itself; only log streams
The IAM policy grants `logs:CreateLogStream` and `logs:PutLogEvents` with a resource ARN that correctly targets log streams under the specified log group. However, the policy lacks any statement that grants permission on the log group resource itself. If the log group does not already exist, the Lambda function requires `logs:CreateLogGroup` permission on the log group ARN (`arn:aws:logs:us-east-1:123456789012:log-group:MyLogGroup`) to create it. Without this, the function cannot create the log group, causing the write to fail. The resource ARN in the policy does not include the log group itself, only log streams, which is why the function lacks the necessary permissions to interact with the log group resource.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The resource ARN does not include the log group itself; only log streams
Why this is correct
PutLogEvents requires access to the log group resource as well.
- ✗
The actions list does not include logs:DescribeLogGroups
Why it's wrong here
DescribeLogGroups is not required for writing logs.
- ✗
The policy is missing an explicit deny for other actions
Why it's wrong here
Explicit deny is not needed; default deny applies.
- ✗
The region in the ARN does not match the Lambda function's region
Why it's wrong here
The region matches us-east-1.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.