DOP-C02 Incident and Event Response Practice Question
A company uses AWS Key Management Service (KMS) to encrypt data at rest. The security team needs to know who attempted to decrypt data using a specific KMS key and whether the attempt succeeded. Which AWS service should the team use?
⚠ Common exam trap
Candidates often confuse AWS Config (which tracks resource configuration) with CloudTrail (which tracks API activity), or they assume KMS key policies themselves provide audit logs, when in fact policies only control permissions and do not generate event records.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail is the correct service because it records all KMS API calls, including Decrypt, Encrypt, and GenerateDataKey, as events in the CloudTrail logs. By examining CloudTrail events for the specific KMS key ID, the security team can see who called the Decrypt API and whether the call succeeded (HTTP 200) or failed (e.g., AccessDenied). This provides the exact audit trail needed for incident response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config is not the correct service because it focuses on recording configuration state and compliance over time, such as whether a KMS key has rotation enabled or whether a key policy was changed. It does not capture discrete API operations like Encrypt, Decrypt, or GenerateDataKey, and therefore cannot provide the audit trail needed to answer who accessed the key and when.
- ✗
KMS key policies
Why it's wrong here
KMS key policies control which principals are allowed to perform which actions on a key, functioning as a resource-based access control document. While they are essential for granting or denying permissions, they are static configuration and do not generate logs or record the actual API calls made against the key. Thus, a key policy cannot help determine whether a specific cryptographic operation was attempted or completed.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is the correct service because it records all KMS API requests as events, including both management-plane actions like CreateKey and EnableKeyRotation and data-plane operations like Encrypt, Decrypt, and GenerateDataKey. Each event includes details such as the caller identity, source IP address, key ID, and timestamp, which allows you to audit key usage and detect unauthorized access after the fact.
- ✗
CloudWatch Logs
Why it's wrong here
CloudWatch Logs by itself does not capture KMS API calls; it is a service for storing, monitoring, and alerting on log data that is explicitly sent to it. Without a separate mechanism like a CloudTrail trail configured to deliver events to a CloudWatch Logs log group, KMS activity would never appear there. Therefore, simply enabling CloudWatch Logs provides no native visibility into KMS operations.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.