DEA-C01 Data Security and Governance Practice Question

A company wants to audit all data access events in their S3 buckets, including who accessed objects and from which IP address. Which AWS service should be used to capture these events?

⚠ Common exam trap

DEA-C01 often tests the difference between CloudTrail management events and data events — candidates who assume default CloudTrail captures object reads miss that data events must be explicitly enabled for S3 object-level auditing.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS CloudTrail with data events enabled

AWS CloudTrail with data events enabled captures object-level S3 operations (GetObject, PutObject, DeleteObject) along with the identity of the caller and the source IP address, which is exactly what is needed for a full data access audit. Management events alone do not capture object reads/writes, so data events must be explicitly turned on.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
AWS CloudTrail with data events enabled
Why this is correct
CloudTrail data events record object-level S3 operations, capturing the requester's identity and source IP address for every GetObject and PutObject call. Management events alone omit these object reads, so enabling data events satisfies the audit requirement for who accessed which object and from where.
✗
Amazon CloudWatch Logs
Why it's wrong here
CloudWatch Logs stores application and resource log output, but S3 object-level access events are delivered to CloudTrail data events, which record the caller identity and source IP. CloudWatch suits metric alarms and custom log analysis, not S3 data-event auditing.
✗
AWS Config
Why it's wrong here
AWS Config records resource configuration changes and compliance state, not individual object read or write events, so it cannot show who accessed an object or from which IP. It fits tracking configuration drift and evaluating rule compliance across accounts.
✗
Amazon S3 Server Access Logs
Why it's wrong here
S3 Server Access Logs record bucket-level requests but omit the requester identity fields that CloudTrail data events capture, so they cannot reliably attribute object access to a specific IAM principal. They suit detailed HTTP request logging for traffic analysis, not identity-based auditing.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Security and Governance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question