CS0-003 Security Operations Practice Question
During a cloud security investigation, a security analyst notices unusual API calls from a compromised IAM user in AWS. The analyst wants to determine the scope of the breach and identify affected resources. Which TWO cloud-native services should the analyst use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail records API activity, and GuardDuty provides threat detection. Both are native services for investigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Shield
Why it's wrong here
AWS Shield is a managed DDoS protection service that safeguards applications from volumetric and state-exhaustion attacks at the network and transport layers. It does not log or audit the API-level activity of authenticated users or services. Therefore, while Shield is useful for availability threats, it cannot provide the request-level evidence needed for a security investigation into suspicious API calls.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is the native governance, compliance, and audit service that records every API call made within an AWS account. It captures essential details such as the identity of the requester, source IP address, request parameters, and response elements, enabling a comprehensive history of user and service activity. For a security analyst investigating unusual API actions, CloudTrail is the primary source of truth because it delivers the complete, tamper-evident audit log required to trace who did what and when.
- ✗
AWS WAF
Why it's wrong here
AWS WAF is a web application firewall that inspects HTTP(S) requests for common attack patterns like SQL injection and cross-site scripting, applying rules to filter malicious web traffic. It operates at the application layer and monitors web requests, not the internal API calls made by cloud identities or services. Because WAF lacks any identity-aware logging of API actions, it cannot serve as the audit trail for an investigation into user or role activity.
- ✗
AWS Config
Why it's wrong here
AWS Config is a configuration management service that records changes to the state of AWS resources, such as security group modifications or EC2 instance type changes. It assesses resource compliance over time using configuration snapshots and rules, but it does not log the operational API calls or the identity of the principal who performed them. Thus, Config reveals what changed in resource configurations, but not the full API request/response history that would indicate unauthorized activity.
- ✓
Amazon GuardDuty
Why this is correct
Amazon GuardDuty is a continuous threat detection service that uses machine learning, anomaly detection, and threat intelligence to analyze AWS log sources, including CloudTrail, VPC Flow Logs, and DNS logs. It can generate findings for suspicious behaviors like compromised credentials or unusual API usage, but it is an analyzer that consumes existing logs rather than a primary audit log itself. For a security analyst needing to review the raw API activity trail, GuardDuty is valuable for triage but not the definitive source of API event history.
Go deeper
Related to this question
Learn chapter
Threat Intelligence and Threat Hunting
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
Key term
Detection
Detection is the process of identifying potential security incidents or anomalies by analyzing system data, logs, and network traffic.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.