Amazon CloudWatch and AWS Trusted Advisor — the generic, foundational observability and best-practice-checking layer that almost every other security service in this study set quietly relies on or gets compared against. Neither is a dedicated "security service" the way GuardDuty or Inspector are, but both show up constantly as integration points, distractors, and standalone exam targets in their own right.
Note: IAM Access Analyzer — originally grouped under "Detective Tooling" — is covered in the IAM & Governance Bundle, since it's structurally an IAM capability. This file focuses on CloudWatch and Trusted Advisor.
Questions here test whether you know these are GENERIC tools layered underneath the specialized security services already covered, not replacements for them. CloudWatch alarms can detect a metric threshold breach, but they don't understand "this is a credential compromise" the way GuardDuty does — you have to build that logic yourself via metric filters/alarms. Trusted Advisor's security checks are real but limited and support-plan-gated — it complements, but doesn't replace, Config or Security Hub CSPM for deep, customizable compliance evaluation.
| Domain | Where This Bundle Shows Up |
|---|---|
| Security Logging & Monitoring | The centerpiece — metric filters, alarms, Logs Insights, anomaly detection |
| Threat Detection & Incident Response | Custom alarm-driven response patterns, EventBridge integration for automated remediation |
| Management & Security Governance | Trusted Advisor's security category checks, Organizational View for multi-account visibility |
A metric crossing an unsafe threshold; unusual patterns in log volume/content that no specialized service is watching for; basic AWS misconfigurations (public S3 buckets, open security group ports, missing root MFA) going unnoticed
Generic, broad-coverage observability and best-practice checking underneath/alongside the specialized detection services
The Detective Tooling Bundle
Build metric filters/alarms on security-relevant log patterns; enable CloudWatch Logs anomaly detection on critical log groups; ensure Business Support+ (or higher) for full Trusted Advisor security check coverage; enable Organizational View for multi-account rollup.
CloudWatch alarms → SNS/EventBridge; Trusted Advisor refreshed checks (automatic on Business Support+, manual on Basic/Developer) surfaced via API/console/EventBridge.
EventBridge-triggered Lambda on alarm/check state change; manual remediation guided by Trusted Advisor's specific recommendation per check.
Exam appearance probability: MEDIUM
anomaly command in Logs Insights queries lets you find unusual patterns ON-DEMAND (not just via a continuously-running detector) — detecting five types of anomalies including pattern frequency changes, new patterns, and token variationsRequirement → Keywords → Expected Answer → why every distractor fails.
CloudTrail → CloudWatch Logs → metric filter → alarm → SNS
| Distractor | Why it's wrong |
|---|---|
| GuardDuty | Could ALSO detect anomalous root usage via its own ML, but the SPECIFIC, deterministic "this exact pattern occurred" alerting is the textbook metric-filter-and-alarm pattern |
| Trusted Advisor | Checks root MFA STATUS (a static configuration check), not real-time LOGIN EVENT alerting |
CloudWatch Logs anomaly detection
| Distractor | Why it's wrong |
|---|---|
| A manually written metric filter | By definition requires you to already know the pattern to write the filter — can't catch something genuinely new |
Trusted Advisor (free-tier security checks)
| Distractor | Why it's wrong |
|---|---|
| Security Hub CSPM | A real, deeper option, but introduces its own per-check evaluation cost — not the "zero incremental cost" answer the requirement specifically calls for |
Trusted Advisor Organizational View
| Distractor | Why it's wrong |
|---|---|
| Manually checking Trusted Advisor in each account individually | Doesn't scale and defeats the purpose of a consolidated view that Organizational View provides natively |
On Basic or Developer Support, Trusted Advisor's Security category checks do NOT refresh automatically — they must be manually refreshed, meaning a stale check result could mask a recently introduced misconfiguration if no one remembers to refresh it.
anomaly Logs Insights command for ad-hoc investigation during incident response, not just continuous detectors| Misconception | Reality |
|---|---|
| "CloudWatch automatically knows what 'malicious' activity looks like, like GuardDuty does" | False — CloudWatch alarms/filters only watch for whatever pattern/threshold YOU explicitly define; its anomaly detection is statistical, not threat-intelligence-driven |
| "All Trusted Advisor checks are available on every Support plan" | False — only 56 of 482 checks are available below Business Support+; the rest require that tier or higher |
| "Trusted Advisor checks always refresh automatically" | Only true on Business Support+ and above — Basic/Developer Support requires manual refresh of Security category checks |
| "Trusted Advisor is a full replacement for AWS Config or Security Hub CSPM" | It's broader (covers cost/performance too) but shallower on security-specific depth and customization — complementary, not a replacement |
| "CloudWatch Logs anomaly detection costs extra to set up" | Creating log anomaly detectors does not incur a charge — standard CloudWatch Logs ingestion/storage costs still apply, but the detector itself is free |
| Comparison | What actually differs |
|---|---|
| CloudWatch vs GuardDuty | Generic, define-it-yourself metric/log monitoring vs purpose-built, pre-trained ML threat detection across curated AWS-native data sources |
| CloudWatch metric anomaly detection vs Logs anomaly detection | Statistical "normal band" around a numeric METRIC vs ML-inferred PATTERN analysis of log TEXT, including detecting genuinely new patterns |
| Trusted Advisor vs AWS Config | Broad, opinionated, support-plan-gated best-practice checks across 6 categories (cost/performance/security/etc.) vs a deep, fully customizable configuration-rule evaluation engine you can extend with your own custom rules |
| Trusted Advisor vs Security Hub CSPM | General AWS best practices, broader scope beyond just security vs standards-mapped (CIS/PCI/NIST/FSBP), security-specific, continuously-scored compliance framework |
| CloudWatch Logs Standard vs Infrequent Access class | Full price, optimized for real-time alarming vs half price, optimized for less time-sensitive logs, now also supporting full Logs Insights querying |
Click card to flip. Mark right or wrong to track score.
SCS-C02 scenario style, Easy → Specialty. Select an answer to reveal the explanation.