ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

AWS CloudTrail records every API call that creates, updates, or deletes security-group rules. Configuring a multi-Region trail to deliver logs to an Amazon S3 bucket protected by Object Lock in compliance mode keeps those log files immutable for the required one-year retention period. By integrating CloudTrail with Amazon EventBridge, management events such as AuthorizeSecurityGroupIngress and RevokeSecurityGroupIngress are delivered to the event bus within seconds, where an EventBridge rule can invoke Amazon SNS (or another target) for immediate alerting. In contrast, VPC Flow Logs only capture network-traffic metadata, not configuration changes; AWS Config can detect drift but evaluations are periodic and its data is not stored with a write-once-read-many control by default; and CloudWatch instance metrics monitor performance, not security-group API activity. Therefore, the combination of CloudTrail, S3 Object Lock, and EventBridge with SNS best satisfies the detection speed, retention, and immutability requirements while relying solely on managed AWS services.