CLF-C02 Security and Compliance Practice Question
A company stores sensitive customer data in an Amazon S3 bucket. The security team wants to record every GetObject and PutObject API call made against the bucket, including the identity of the caller, the source IP address, and the time of the request. They need to store these records in a separate centralized S3 bucket and analyze them using Amazon Athena for security audits. Which AWS feature should the security team enable?
⚠ Common exam trap
AWS often tests the distinction between S3 server access logs (which log requests but lack caller identity) and CloudTrail data events (which capture full API details including identity), leading candidates to mistakenly choose server access logging for security auditing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail data events
AWS CloudTrail data events (Option C) are the correct choice because they capture detailed information about S3 object-level API operations such as GetObject and PutObject, including the caller identity, source IP address, and request time. These logs can be delivered to a centralized S3 bucket and queried using Amazon Athena for security audits, meeting all stated requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config managed rules
Why it's wrong here
AWS Config managed rules assess whether S3 bucket configurations comply with desired policies, such as requiring encryption or blocking public access, by evaluating the bucket's resource state. These rules trigger on configuration changes, not on object-level API calls, so they never see GetObject or PutObject requests. Even when AWS Config records configuration history, it does not capture the caller identity, source IP, or timestamp for individual data access attempts, making it unsuitable for auditing access to sensitive customer data.
When this WOULD be correct
A company wants to automatically detect and remediate S3 buckets that are publicly accessible. Enabling AWS Config managed rules (e.g., s3-bucket-public-read-prohibited) would continuously evaluate bucket policies and trigger remediation actions.
- ✗
Amazon S3 server access logging
Why it's wrong here
Incorrect. S3 server access logs provide detailed records about requests made to a bucket, but they do not include the caller identity (IAM user or role) reliably, and they are not directly queryable by Amazon Athena without additional setup. AWS CloudTrail data events offer better integration for auditing.
When this WOULD be correct
A company needs to track all HTTP requests to an S3 bucket for operational monitoring, including request types, response status, and total bytes transferred, but does not require caller identity or IP address. They plan to store logs in another S3 bucket and analyze them with log analysis tools.
- ✓
AWS CloudTrail data events
Why this is correct
Correct. AWS CloudTrail data events capture object-level API operations on Amazon S3 objects, including GetObject and PutObject. These logs include caller identity, source IP, and request time. They can be delivered to an S3 bucket and queried with Amazon Athena for security audits.
- ✗
Amazon GuardDuty
Why it's wrong here
Incorrect. Amazon GuardDuty is a threat detection service that uses machine learning and threat intelligence to identify suspicious activity. It does not record every API call by default and is not designed to provide a complete audit trail of all GetObject and PutObject requests.
When this WOULD be correct
A company wants to continuously monitor S3 buckets for suspicious access patterns, such as unusual data exfiltration or anomalous API calls, and receive automated alerts. GuardDuty would be the correct choice for threat detection and alerting.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS CloudTrail data eventsCorrect answer▾
Why this is correct
Correct. AWS CloudTrail data events capture object-level API operations on Amazon S3 objects, including GetObject and PutObject. These logs include caller identity, source IP, and request time. They can be delivered to an S3 bucket and queried with Amazon Athena for security audits.
✗AWS Config managed rulesWrong answer — click to see why▾
Why this is wrong here
AWS Config managed rules evaluate resource configurations for compliance, but they do not record individual API calls like GetObject or PutObject, nor do they capture caller identity, source IP, or request time.
★ When this WOULD be the correct answer
A company wants to automatically detect and remediate S3 buckets that are publicly accessible. Enabling AWS Config managed rules (e.g., s3-bucket-public-read-prohibited) would continuously evaluate bucket policies and trigger remediation actions.
Why candidates choose this
Candidates may confuse AWS Config's compliance monitoring with logging API calls, assuming it records all changes and access events, when it actually focuses on configuration drift rather than data-level operations.
✗Amazon S3 server access loggingWrong answer — click to see why▾
Why this is wrong here
Amazon S3 server access logging provides records of requests made to a bucket, but it does not capture the identity of the caller (e.g., IAM user or role) or the source IP address in a structured format suitable for Athena analysis. It logs details like requester type (e.g., AWS account ID) but not the specific caller identity or IP address required by the question.
★ When this WOULD be the correct answer
A company needs to track all HTTP requests to an S3 bucket for operational monitoring, including request types, response status, and total bytes transferred, but does not require caller identity or IP address. They plan to store logs in another S3 bucket and analyze them with log analysis tools.
Why candidates choose this
Candidates may confuse server access logging with CloudTrail data events because both can log S3 API calls, but server access logging is simpler and often used for basic request tracking, leading them to overlook the requirement for caller identity and IP address.
✗Amazon GuardDutyWrong answer — click to see why▾
Why this is wrong here
Amazon GuardDuty is a threat detection service that monitors for malicious activity, but it does not record detailed data events like GetObject and PutObject API calls with caller identity and source IP for auditing purposes.
★ When this WOULD be the correct answer
A company wants to continuously monitor S3 buckets for suspicious access patterns, such as unusual data exfiltration or anomalous API calls, and receive automated alerts. GuardDuty would be the correct choice for threat detection and alerting.
Why candidates choose this
Candidates may confuse GuardDuty's monitoring capabilities with auditing features, thinking it can log all API calls, but GuardDuty focuses on threat detection rather than detailed event recording for compliance audits.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.