DOP-C02 Security Monitoring and Auditing Guide

The last security task on DOP-C02 is about proving what happened and detecting what should not have happened. AWS is testing whether logs, findings, and configuration evidence become a useful security signal instead of an archive no one can act on.

Audit versus detection

Keep these separate:

• auditing asks what changed, who did it, and whether the state matches policy
• detection asks whether the platform is seeing threats, exposures, or anomalous behavior quickly enough

Strong answers often include both, but they are not the same control.

Common security signal sources

The current AWS domain guidance points to:

• CloudTrail
• AWS Config
• VPC Flow Logs
• CloudFormation drift detection
• GuardDuty
• Inspector
• IAM Access Analyzer

That means the exam is often asking which evidence source best matches the question: change history, configuration drift, traffic behavior, vulnerability findings, or unintended access exposure.

Strong monitoring patterns

Common traps

• treating raw logs as a completed monitoring strategy
• using one findings service for a configuration-drift problem
• collecting audit trails without any alerting or review workflow
• answering with CloudTrail when the real problem is exposed access or resource policy drift

Fast decision rule

When the question is about who changed what, think audit trail. When it is about what is misconfigured or drifting, think configuration and policy state. When it is about what looks dangerous or exposed right now, think security findings and alerting.