The correct next step is to review the CloudWatch alarm configuration, specifically the period and threshold settings. Even when a metric filter on CloudTrail logs successfully produces data points for events like CreateAccessKey, the alarm may fail to trigger if its evaluation period is too long or its threshold is set too high—for example, requiring more than one data point within a five-minute window when access keys are created sporadically. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding that a working metric filter does not guarantee a working alarm; the trap is assuming the alarm is automatically correct once the filter shows data. The exam often pairs this with questions about SNS topic permissions or log delivery delays, but the most common oversight is misaligned alarm parameters. Remember the memory tip: “Filter finds, alarm alarms—check the period and threshold before you panic.”
SCS-C02 Threat Detection and Incident Response Practice Question
This SCS-C02 practice question tests your understanding of threat detection and incident response. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses AWS CloudTrail to log all API activity. The security team wants to be alerted when an IAM user creates a new access key. They have created a CloudWatch metric filter on the CloudTrail log group for the event name 'CreateAccessKey' and set up a CloudWatch alarm that sends an email via Amazon SNS. However, the alarm is not triggering even though the team knows that access keys have been created. The metric filter has been tested and shows data points in CloudWatch. What should the security team check next?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the CloudWatch alarm configuration, including the period and threshold.
Option C is correct because the metric filter is producing data points, which means logs are being ingested and the filter is matching events. The most likely issue is that the CloudWatch alarm's period or threshold is misconfigured—for example, the evaluation period might be too long or the threshold too high, causing the alarm to not transition to ALARM state despite the metric having values. The security team should verify the alarm's settings, such as the period (e.g., 5 minutes) and the threshold (e.g., >= 1), to ensure they align with the expected frequency of access key creation events.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Ensure that the CloudTrail trail is delivering logs to the correct CloudWatch Logs log group.
Why it's wrong here
If the metric filter shows data, the logs are being delivered correctly.
✗
Verify that the CloudTrail trail is logging data events.
Why it's wrong here
CreateAccessKey is a management event, which is logged by default.
✓
Review the CloudWatch alarm configuration, including the period and threshold.
Why this is correct
The alarm may be misconfigured with a period that is too long or a threshold that is not crossed.
Related concept
Read the scenario before looking for a memorised answer.
✗
Check that the IAM user has permissions to create access keys.
Why it's wrong here
The alarm should trigger regardless of whether the action succeeded or failed.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume the issue must be with log delivery or event type, but the metric filter already shows data points, so the problem lies in the alarm's evaluation configuration—specifically the period and threshold settings that control when the alarm triggers.
Trap categories for this question
Command / output trap
If the metric filter shows data, the logs are being delivered correctly.
Detailed technical explanation
How to think about this question
CloudWatch alarms evaluate metrics over a specified period and number of datapoints (e.g., 1 out of 1 datapoints above threshold). If the alarm's period is set to 5 minutes but the metric filter produces a datapoint every 10 minutes, the alarm may never see enough datapoints to evaluate. Additionally, the alarm's 'Treat missing data as' setting can cause it to remain in INSUFFICIENT_DATA state if not configured correctly, even when valid datapoints exist.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Threat Detection and Incident Response — This question tests Threat Detection and Incident Response — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Review the CloudWatch alarm configuration, including the period and threshold. — Option C is correct because the metric filter is producing data points, which means logs are being ingested and the filter is matching events. The most likely issue is that the CloudWatch alarm's period or threshold is misconfigured—for example, the evaluation period might be too long or the threshold too high, causing the alarm to not transition to ALARM state despite the metric having values. The security team should verify the alarm's settings, such as the period (e.g., 5 minutes) and the threshold (e.g., >= 1), to ensure they align with the expected frequency of access key creation events.
What should I do if I get this SCS-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS CloudTrail to log all API activity. The security team wants to ensure that any changes to CloudTrail configuration (e.g., disabling the trail, deleting the trail, modifying the log delivery) are detected immediately. They have created a CloudWatch Events rule to capture the event 'StopLogging' and send an SNS notification. During testing, the team stops the trail and does not receive the notification. The CloudWatch Events rule is configured with the correct event pattern. What should the team check?
easy
A.Verify that the CloudTrail trail is logging management events.
B.Ensure that the event pattern includes the correct source and detail-type.
C.Confirm that the SNS topic subscription is confirmed.
✓ D.Check the IAM role associated with the CloudWatch Events rule to ensure it has permissions to publish to the SNS topic.
Why D: Option B is correct because CloudWatch Events rules require an IAM role to invoke the SNS topic. The role must have sns:Publish permissions. Option A is wrong because the trail is logging management events by default. Option C is wrong because the event pattern is correct, but the target action fails. Option D is wrong because SNS topic subscriptions are for subscribers, not for publishing.
Variation 2. A security engineer is configuring AWS CloudWatch Logs to monitor for suspicious activity. They want to create a metric filter that detects when an IAM user calls the `iam:CreateAccessKey` API. The engineer writes the following filter pattern: `{ ($.eventName = "CreateAccessKey") }`. After testing, the filter does not trigger. What is the most likely reason?
hard
A.The filter pattern syntax is incorrect; it should use square brackets.
B.The metric filter is not associated with the correct log group.
C.CloudWatch Logs does not support metric filters for CloudTrail logs.
✓ D.The filter pattern does not include the eventSource field, so it might match events from other services.
Why D: CloudTrail logs are JSON objects. The filter pattern must match the JSON structure. The correct pattern should include the eventSource or use the proper path. Typically, the pattern should be `{ ($.eventSource = "iam.amazonaws.com") && ($.eventName = "CreateAccessKey") }`. Without eventSource, the filter may match other services with the same event name.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.