DOP-C02 Security and Compliance Practice Question
A company uses AWS KMS to encrypt data in S3. They want to audit who used which KMS key and when. Which AWS service should they use?
⚠ Common exam trap
Many candidates confuse CloudWatch Logs (which can store logs) with CloudTrail (which captures the API audit trail), leading them to pick CloudWatch because they think 'audit logs' are just logs, but only CloudTrail records the specific KMS API calls needed for key usage auditing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail is the correct service because it records all AWS KMS API calls, including the key ID, the principal who made the request, the time of the request, and the source IP address. These logs are delivered to an S3 bucket and can be queried using CloudTrail Insights or Athena to audit KMS key usage for S3 decryption events.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon CloudWatch
Why it's wrong here
Amazon CloudWatch is a monitoring and observability service that collects metrics, logs, and alarms but is not the source of API audit trails. While CloudTrail can deliver KMS API events to CloudWatch Logs for metric filters and alarm thresholds, CloudWatch itself does not record or capture the raw KMS calls such as Decrypt or GenerateDataKey. The authoritative record of KMS API activity is maintained by CloudTrail, which then may be forwarded to CloudWatch for operational alerting.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat detection service that uses machine learning and anomaly detection on AWS data sources like DNS queries, VPC Flow Logs, and CloudTrail management events, but it does not produce its own audit trail of KMS API calls. GuardDuty can flag suspicious patterns in CloudTrail logs—such as an unusually high volume of GenerateDataKey calls—but it is not the service to query for a complete, chronological record of who called KMS operations. For auditing the actual KMS API activity, you need CloudTrail, and GuardDuty's findings are separate from the auditable events themselves.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is the correct answer because it records KMS API calls as data events, providing the principal, key ID, source IP address, and timestamp for each operation. When data events are enabled for a customer master key, CloudTrail captures every Encrypt, Decrypt, GenerateDataKey, and ScheduleKeyDeletion call, which is exactly what is needed to audit encryption usage. This KMS activity is delivered as a JSON event to an S3 bucket (and optionally to CloudWatch Logs), forming a durable, tamper-evident audit trail for compliance and security investigations.
- ✗
AWS Config
Why it's wrong here
AWS Config is a configuration auditing service that records resource provisioning and configuration changes—for example, whether KMS key rotation is enabled, the key policy, or the state of a CMK—not the API operations that use the key. While Config can help enforce compliance rules like 'ensure KMS keys have automatic rotation', it does not log individual data-plane calls such as Decrypt or Encrypt performed by IAM principals. The only service that provides the requested API-level audit trail for KMS is CloudTrail.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.