DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Config

  Why it's wrong here

  AWS Config is a resource inventory and compliance service that tracks the configuration state of your S3 bucket over time—such as changes to bucket policies, lifecycle rules, or encryption settings—but it does not record API call activity or object-level requests. An audit of access requires knowing who performed each GetObject or PutObject, which Config never captures because it operates on configuration snapshots, not data-plane operation logs. Thus, AWS Config cannot answer the who/what/when of S3 bucket access.

• ✓

  S3 server access logs

  Why this is correct

  S3 server access logging records every request made to a bucket, including the requester's IP address (or IAM role/account if available), the request operation (e.g., REST.GET.OBJECT), the object key, response status, and timestamps, then delivers these logs to a destination bucket you designate. These logs provide a comprehensive object-level audit trail of both authenticated and unauthenticated access, making them a direct answer to the audit requirement. Keep in mind the logs are delivered on a best-effort basis with no guarantee of completeness, but they are still the standard method for forensic analysis of S3 access.

• ✓

  AWS CloudTrail

  Why this is correct

  AWS CloudTrail is the native audit service that records API activity across your AWS account, including S3 management events like CreateBucket and, when data events are enabled, object-level operations such as GetObject, PutObject, and DeleteObject. Each event includes the IAM principal, source IP address, request parameters, and response elements, so CloudTrail provides a near-real-time, complete audit trail of who accessed which S3 object and when. Enabling CloudTrail data events for S3 buckets is a common best practice for meeting access audit requirements.

• ✗

  AWS KMS

  Why it's wrong here

  AWS Key Management Service is a managed service for creating and controlling the cryptographic keys used to protect data, such as SSE-KMS encryption keys for S3 objects. While KMS generates CloudTrail events for key usage (e.g., when an object is decrypted), it does not itself record or report on who accessed the S3 bucket or what operations were performed on objects. KMS supports encryption, not logging, so it would be an enabling technology for a secure audit trail, not an audit tool for S3 access.

• ✗

  Amazon CloudWatch Logs

  Why it's wrong here

  Amazon CloudWatch Logs is a service for collecting, monitoring, and querying log data from applications and AWS services, but S3 does not natively send its access logs to CloudWatch Logs. Rather, S3 server access logs are written to an S3 bucket, and CloudTrail events can be optionally streamed to CloudWatch Logs for real-time alarm or metric purposes. As a result, CloudWatch Logs can be a downstream destination or analysis layer, but it is not a direct source of S3 bucket access data and cannot by itself audit access.

Go deeper

Related to this question