DEA-C01 Data Security and Governance Practice Question
A data engineer needs to audit data access in Amazon S3 for compliance. Which TWO services can be used to capture and analyze S3 access logs? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail (B) is correct because it records S3 data events (object-level operations like GetObject and PutObject) and management events, delivering them to CloudTrail logs or CloudWatch Logs for auditing and analysis of who accessed what in S3. S3 server access logs (C) are correct because they provide detailed, best-effort records of every request made to a bucket, including requester, bucket, key, operation, and response codes, which can be stored and analyzed for compliance auditing. Amazon CloudWatch Logs (A) is not a log source for S3 access itself; it only stores and analyzes logs that are delivered to it by other services such as CloudTrail. Amazon Macie (D) is a data security service that discovers and classifies sensitive data in S3, not a service for capturing S3 access logs. AWS Config (E) tracks resource configuration changes and compliance against rules, not individual S3 data access events.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon CloudWatch Logs
Why it's wrong here
CloudWatch Logs stores and analyses log streams but does not itself capture S3 access events; S3 must deliver logs elsewhere first. It is tempting because CloudWatch Logs Insights queries log data well. Capturing S3 access requires S3 server access logging or CloudTrail data events feeding those logs.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail records S3 data-plane API calls such as GetObject and PutObject, capturing the identity, source IP and timestamp of each access. This satisfies the audit requirement by providing an analysable event trail for compliance, complementing S3 server access logs.
- ✓
S3 server access logs
Why this is correct
S3 server access logs record every request against a bucket, capturing requester, operation, timestamp and response code, and are delivered to a target bucket for analysis with Athena or CloudTrail Lake, satisfying the audit requirement for object-level access detail.
- ✗
Amazon Macie
Why it's wrong here
Amazon Macie discovers and classifies sensitive data in S3 using machine learning; it does not capture access logs. It is tempting because Macie reports on buckets and objects, which looks like auditing. Compliance auditing of who accessed which object needs S3 server access logs or CloudTrail data events instead.
- ✗
AWS Config
Why it's wrong here
AWS Config records resource configuration changes and evaluates compliance rules; it does not capture S3 data-access events. It is tempting because Config can track bucket policy and ACL changes, which suits configuration-compliance auditing. Capturing and analysing actual object access requires S3 server access logging or CloudTrail data events.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.