DOP-C02 Incident and Event Response Practice Question
A company uses AWS CloudTrail to log all API calls. During an incident investigation, a security engineer needs to identify who deleted an S3 bucket named 'critical-data' two days ago. Which approach will provide the necessary information?
⚠ Common exam trap
DOP-C02 often tests the boundary between CloudTrail management events and S3 access logs, so candidates pick S3 access logs because the resource is an S3 bucket, missing that bucket deletion is a management event captured by CloudTrail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS CloudTrail LookupEvents API to search for DeleteBucket events.
CloudTrail records management events such as DeleteBucket, and the LookupEvents API allows programmatic search of the last 90 days of event history by event name, so it can identify who deleted the bucket two days ago. This is the intended mechanism for API-level auditing. The other options either lack the event detail, cover only data-plane access, or require prior configuration that is not guaranteed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS CloudTrail LookupEvents API to search for DeleteBucket events.
Why this is correct
The AWS CloudTrail LookupEvents API is the correct method because it directly queries CloudTrail's event history, which records all control plane API calls such as DeleteBucket. You can use the LookupAttributes parameter with AttributeKey=EventName and AttributeValue=DeleteBucket, filtering by time range if needed. This returns the full event record, including the IAM user or role, source IP, and timestamp, for any deletion within the last 90 days. It is the native, low-latency mechanism for exactly this forensic search.
- ✗
Check the AWS Management Console activity history.
Why it's wrong here
The AWS Management Console does not maintain a built-in activity history for API calls; it is a UI that displays current resource state, and once a bucket is deleted, no console screen retains a log of that action. The 'Event history' feature you may think of is actually part of the CloudTrail service, not the console itself. Without navigating to CloudTrail's dedicated Event History page, which uses the LookupEvents API behind the scenes, the console offers no way to review past API activity. Therefore, this option is not a viable mechanism.
- ✗
Review the S3 access logs for the bucket.
Why it's wrong here
S3 server access logs (also called bucket logs) are data plane logs that record object-level requests such as GET, PUT, POST, and LIST. They are delivered to a separate S3 bucket as delimited text files, but they do not capture control plane operations like DeleteBucket. Deleting a bucket is an account-level action that terminates the bucket itself, so any access log that was destined for the bucket would also be lost or unavailable. Even if you had configured logging to another bucket, the log entries would only show object requests, never the bucket deletion API call.
- ✗
Search CloudWatch Logs for 'DeleteBucket' events.
Why it's wrong here
CloudWatch Logs does not automatically receive CloudTrail events unless you explicitly create a CloudTrail trail with a CloudWatch Logs destination and select a log group. Without that configuration, CloudWatch Logs contains only your application and service logs, not a record of API calls. So searching for 'DeleteBucket' would return nothing because the event is never streamed there by default. If you did have that trail set up, you would need precise log group and filter pattern knowledge, but the question implies no such setup has been established, making CloudWatch Logs an incorrect source.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.