Observability Blind Spot — AWS Security Specialty (SCS-C03)
You missed a monitoring or logging requirement. The exam tests whether you know what to observe, not just what to build.
Detection Alone Doesn't Satisfy the Audit Requirement
The scenario requires root-cause traceability, configuration change history, or automated remediation — the distractor delivers one of these but not the right one. CloudWatch Logs detects anomalies; it doesn't produce an immutable audit trail of API-level changes. GuardDuty identifies threat signals; it doesn't record who changed a security group rule. AWS Config records configuration state over time and can trigger automated remediation via Config Rules — that's the distinction the exam tests. Match the tool to the specific observability obligation, not the general category.
The Scenario
A serverless application with API Gateway, Lambda, and DynamoDB returns slow responses. CloudWatch shows Lambda duration averages 5 seconds but no errors. You recommend CloudWatch alarms on duration metrics. The correct answer is enabling X-Ray tracing to identify which downstream call is slow. X-Ray traces the full request: API Gateway routing (200ms), Lambda cold start (800ms), DynamoDB query (3,200ms), response serialization (800ms). The bottleneck is a DynamoDB scan operation that should be a query. CloudWatch metrics tell you Lambda is slow; X-Ray tells you why. The scenario asked "diagnose latency issues" — that requires request-level tracing, not service-level metrics.
How to Spot It
- •CloudWatch Metrics shows aggregated health (error rates, duration, throttles). CloudWatch Logs shows individual event details (error messages, stack traces). X-Ray shows request flow across services (where time is spent, which service is the bottleneck). Match the diagnostic tool to the question: "Is it broken?" = Metrics. "What happened?" = Logs. "Where is the bottleneck?" = X-Ray.
- •CloudWatch Container Insights for ECS/EKS provides CPU, memory, and network metrics per container. But if the scenario asks why inter-service calls are slow, Container Insights shows resource utilization, not request-level latency. You need X-Ray or Application Signals for request tracing across services.
- •Distributed architectures (Lambda calling SQS calling another Lambda calling DynamoDB) create blind spots at every service boundary. Per-service metrics cannot show that the bottleneck is in the SQS consumer, not the producer. The exam tests whether you recognize when distributed tracing is required.
Decision Rules
Whether the selected logging architecture spans all three security-relevant layers — identity (CloudTrail), application (CloudWatch), and network (VPC Flow Logs + Route 53 Resolver DNS logs) — because omitting the network layer makes lateral movement between accounts or VPCs undetectable regardless of how complete the identity and application coverage is.
Whether the logging architecture explicitly ingests Route 53 Resolver query logs as a distinct DNS-layer source into Security Lake — without which DNS-based C2 beaconing is undetectable even when CloudTrail and Security Hub findings are fully centralized.
Domain Coverage
Difficulty Breakdown
Related Patterns