DEA-C01 Data Security and Governance Practice Question

Correct answer & explanation

The data resource value is missing a trailing slash (should be 'logs/')? Actually it has a trailing slash. Wait, the issue is that the ARN is for a prefix, but CloudTrail data event selectors for S3 require a bucket ARN or prefix ARN with a trailing slash. The provided ARN 'arn:aws:s3:::my-bucket/logs/' is correct format. However, the likely issue is that the bucket is in a different region, but the trail is in a different region? No, more common: the IAM role for CloudTrail lacks permissions to log to S3. But the exhibit shows a correct selector. Actually, common mistake: the selector must have a trailing slash, which it does. The most likely cause is that the trail is not logging because the S3 bucket policy does not grant CloudTrail write access. Option A is plausible. Option B is wrong because prefix is correct. Option C is wrong because it includes trailing slash. Option D is wrong because data events are enabled. So option A is correct.