DOP-C02 Security and Compliance Practice Question

A company needs to audit all changes to IAM policies in their AWS account. Which services can be used to track and log these changes? (Select TWO.)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS Config

AWS CloudTrail logs API calls, including IAM policy changes. AWS Config can track configuration changes to IAM resources. CloudWatch Logs stores logs but does not track changes itself. GuardDuty is for threat detection. S3 is storage.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Amazon S3
Why it's wrong here
Amazon S3 is a highly scalable object storage service designed to store and retrieve files, not to audit or track configuration changes. While S3 can serve as a delivery destination for CloudTrail logs or AWS Config snapshots, it does not natively capture or record IAM policy modifications. Therefore, S3 alone cannot provide a history of IAM policy changes.
✗
Amazon CloudWatch Logs
Why it's wrong here
Amazon CloudWatch Logs is a service for ingesting, storing, and monitoring log files from various AWS resources, but it has no inherent knowledge of IAM policy changes. It can receive IAM-related events only if CloudTrail is configured to stream its trails to CloudWatch Logs, making it a passive log destination rather than a change-tracking service. CloudWatch Logs also lacks configuration timelines or compliance evaluation for IAM resources.
✓
AWS Config
Why this is correct
AWS Config is purpose-built for recording and evaluating configuration changes to AWS resources, including IAM policies. It continuously records the configuration state of IAM users, roles, groups, and their attached or inline policies, and maintains a configuration history with a timeline for each resource. You can query the configuration timeline to see what the policy document looked like before and after each change, making it the ideal service for auditing all changes to IAM policies.
✓
AWS CloudTrail
Why this is correct
AWS CloudTrail records every API call made to the IAM service, such as PutRolePolicy, CreatePolicy, and AttachUserPolicy, capturing details like the user, source IP, and request parameters. This audit log provides a forensic record of who performed an IAM policy change and when, which is essential for security investigations. However, CloudTrail gives you the API events but does not maintain a historical state timeline of the policy configuration between changes.
✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat detection service that uses machine learning and integrated intelligence to identify suspicious activity like malicious API calls or compromised credentials, not to track configuration changes. It does not record or maintain a history of IAM policy modifications, nor does it evaluate policy compliance. While GuardDuty may alert on unusual IAM-related activity, it cannot serve as an audit trail for IAM policy changes.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DOP-C02 Security and Compliance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question