CS0-003 Security Operations Practice Question
During a cloud security investigation, an analyst notices that an AWS IAM user generated multiple 'CreateKeyPair' API calls from an IP address outside the corporate network. Which AWS service is best suited to detect this type of anomalous behavior?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS GuardDuty
AWS GuardDuty uses machine learning and threat intelligence to detect anomalous API activity, including unauthorized key creation, via CloudTrail logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudTrail
Why it's wrong here
While AWS CloudTrail is the service that records API calls and event history across the AWS infrastructure, it acts solely as a logging mechanism rather than an active detection engine. It provides the raw audit logs used for forensic analysis but lacks the built-in machine learning and threat intelligence capabilities required to automatically flag anomalous API activity.
- ✗
AWS Config
Why it's wrong here
AWS Config is designed to continuously monitor, record, and assess the configurations of AWS resources against desired compliance baselines. It is highly effective for detecting drift and unauthorized configuration changes, but it does not analyze real-time API call streams for behavioral anomalies or active security threats.
- ✓
AWS GuardDuty
Why this is correct
AWS GuardDuty is a continuous security monitoring service that actively analyzes CloudTrail management events, VPC flow logs, and DNS query logs using threat intelligence and machine learning. It is specifically engineered to detect anomalous API operations, credential compromise, and malicious activity within an AWS environment, generating actionable security findings.
- ✗
AWS Inspector
Why it's wrong here
Amazon Inspector is an automated vulnerability management service that scans EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure. It operates at the host and package level rather than monitoring control plane API calls or detecting active behavioral anomalies in cloud management traffic.
Go deeper
Related to this question
Learn chapter
IOCs vs IOAs and Threat Indicators
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 701 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.