DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable CloudTrail data events for the S3 bucket containing the encrypted objects.

  Why it's wrong here

  Enabling CloudTrail data events for an S3 bucket logs object-level API operations such as GetObject, PutObject, and DeleteObject directly on the S3 objects. While these objects might be encrypted using AWS KMS, the S3 data events do not capture the actual KMS API calls (e.g., Encrypt, Decrypt) that S3 makes to KMS on behalf of the user. To audit the cryptographic operations themselves, KMS-specific data events must be configured.

• ✗

  Create an additional CloudTrail trail that logs all management events for the KMS key.

  Why it's wrong here

  Creating an additional CloudTrail trail that logs only management events will not fulfill the requirement to audit cryptographic operations. CloudTrail management events primarily capture control plane operations, such as creating, modifying, or deleting KMS keys and their policies (e.g., CreateKey, DisableKey, PutKeyPolicy). They do not log data plane operations like Encrypt, Decrypt, or GenerateDataKey, which are the actual cryptographic operations performed using the key.

• ✓

  Enable CloudTrail data events for the specific KMS key ARN.

  Why this is correct

  CloudTrail data events for KMS record every call to Decrypt, Encrypt, GenerateDataKey, etc. By specifying the key ARN in the data event selector, only operations on that key are logged, meeting the audit requirement without excessive logging.

• ✗

  Enable CloudTrail Insights events on the existing trail.

  Why it's wrong here

  CloudTrail Insights is an advanced feature that analyzes existing CloudTrail events to detect unusual API activity patterns, such as spikes in API calls or calls from unusual locations. However, Insights does not change which types of events are logged by the trail. If the underlying trail is not already configured to capture KMS data events (like Encrypt or Decrypt), Insights will have no cryptographic operations to analyze or detect anomalies from, as it only processes events that are already being recorded.