DOP-C02 Incident and Event Response Practice Question
Network Topology
A company configures AWS CloudTrail to deliver logs to S3 bucket 'my-app-logs'. However, no log files appear. The DevOps engineer runs the above command and sees the bucket policy. What is the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The service principal in the bucket policy is incorrect; it should be 'cloudtrail.amazonaws.com'.
CloudTrail requires the S3 bucket policy to grant the service principal 'cloudtrail.amazonaws.com' for delivering logs. The bucket policy shown likely contains 'delivery.logs.amazonaws.com' which is incorrect and prevents log delivery. Option A is wrong because the policy does allow s3:PutObject. Option B is wrong because CloudTrail can deliver to buckets with various ACL settings as long as the policy is correct. Option D is wrong because the bucket exists and the policy retrieval succeeded.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The bucket policy requires bucket-owner-full-control ACL, but CloudTrail does not support ACLs.
Why it's wrong here
CloudTrail does in fact support ACLs and the s3:x-amz-acl condition key. The standard CloudTrail bucket policy includes a Condition that requires the x-amz-acl header to be bucket-owner-full-control, and CloudTrail will include that ACL on the objects it delivers. Therefore, a bucket policy that requires this ACL is valid and is not a cause of the delivery failure; the problem lies elsewhere, namely an incorrect principal.
- ✗
The bucket policy does not allow the s3:PutObject action.
Why it's wrong here
The CloudTrail S3 bucket policy explicitly grants s3:PutObject to the CloudTrail service principal, and this is the fundamental permission needed for log delivery. If this action were missing, the failure would indeed be an access-denied error; however, the policy in question includes s3:PutObject for the correct resource, so the missing-action theory is contradicted. The real bug is that the subject of that permission—the principal—is wrong, not the action.
- ✓
The service principal in the bucket policy is incorrect; it should be 'cloudtrail.amazonaws.com'.
Why this is correct
The bucket policy must specify the CloudTrail service principal as 'cloudtrail.amazonaws.com' in a statement with Principal: {"Service": "cloudtrail.amazonaws.com"}. Using any other principal (an IAM role, another AWS service, or a malformed name) means CloudTrail's S3 requests are not authorized, even though the action is allowed in principle. This is the actual misconfiguration causing the events not to be delivered.
- ✗
The bucket does not exist; the policy retrieval failed silently.
Why it's wrong here
The fact that the bucket policy was retrieved and inspected means the bucket exists and the caller has permission to read the policy; otherwise the API would return a NoSuchBucket or AccessDenied, not a policy document. A nonexistent bucket is a separate and more fundamental problem that would occur before policy evaluation, and it would generate a different error message. Consequently this option cannot explain the permission problem observed.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Drag and drop the steps to troubleshoot an AWS CloudTrail that is not logging API calls.
medium- ✓ A.Verify CloudTrail is enabled, then Check bucket policy, then Check log file integrity, then Check IAM role, then Test CloudTrail logging
- B.Check bucket policy, then Check IAM role, then Verify CloudTrail is enabled, then Check log file integrity, then Test CloudTrail logging
- C.Verify CloudTrail is enabled, then Check log file integrity, then Check bucket policy, then Check IAM role, then Test CloudTrail logging
- D.Check IAM role, then Verify CloudTrail is enabled, then Check bucket policy, then Check log file integrity, then Test CloudTrail logging
Why A: First verify CloudTrail is enabled, then check bucket policy, then check integrity, then check IAM role, then test.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.