DEA-C01 Data Security and Governance Practice Question
A company uses Amazon S3 to store log files. The security team notices that some objects are being accessed from an unexpected AWS account. The data engineer needs to identify which specific IAM user or role is accessing the objects. Which AWS service should be used to get this information?
⚠ Common exam trap
DEA-C01 often tests the difference between S3 server access logs (which lack IAM identity) and CloudTrail data events (which include the IAM principal), leading candidates to choose the wrong service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail records API activity in your AWS account, including S3 data events such as GetObject, PutObject, and DeleteObject. To identify the specific IAM user or role accessing S3 objects, you need to enable S3 data events in CloudTrail, which will log the identity of the caller. CloudTrail is the correct service for auditing and tracking user activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Trusted Advisor
Why it's wrong here
Trusted Advisor inspects account-wide cost, quota and security posture checks; it holds no per-object request records, so it cannot name the IAM principal behind the accesses. It is tempting because its security category flags exposed buckets, and it would be right for surfacing misconfigured public access or missing bucket policies rather than tracing individual callers.
- ✗
Amazon S3 server access logs
Why it's wrong here
S3 server access logs record the requester's canonical user ID and bucket owner, not the assumed IAM role session that CloudTrail data events capture, so cross-account role identity stays ambiguous. It is tempting because it logs every object request, and it would be right for auditing bucket-level access patterns or traffic volume rather than attributing a specific principal.
- ✓
AWS CloudTrail
Why this is correct
CloudTrail records the identity of the principal making each S3 data-plane API call, including the IAM user or role ARN and the source account. This satisfies the stem's need to attribute unexpected cross-account object access to a specific identity.
- ✗
AWS Config
Why it's wrong here
AWS Config evaluates resource configuration against rules and records configuration changes; it captures bucket policy or ACL state, not the identity of each object request. It is tempting because it detects drift such as a bucket becoming public, and it would be right for compliance auditing of resource settings rather than attributing access to a specific IAM user or role.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,321 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.