DOP-C02 Monitoring and Logging Practice Question
A company wants to ensure that all changes to its Amazon S3 bucket policies are logged for auditing purposes. Which TWO AWS services should be enabled to capture these changes?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
Options B and E are correct because AWS Config records resource configuration changes, including S3 bucket policies, and AWS CloudTrail logs API calls such as PutBucketPolicy. Option A is incorrect because Amazon CloudWatch monitors operational metrics and logs, not auditing of policy changes. Option C is incorrect because Amazon GuardDuty provides threat detection, not audit logging. Option D is incorrect because VPC Flow Logs capture network traffic, not configuration changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon CloudWatch
Why it's wrong here
Amazon CloudWatch is an operational telemetry service that collects and monitors metrics, logs, and alarms from AWS resources. It does not track resource configuration changes, such as modifications to S3 bucket policies, because those are control-plane events, not performance or log data. While CloudWatch Events or EventBridge can react to CloudTrail events, CloudWatch itself does not record or retain a definitive history of policy mutations itself.
- ✓
AWS Config
Why this is correct
AWS Config is the correct service for this requirement because it continuously records and evaluates the configuration of AWS resources, including S3 bucket policies, and maintains a detailed configuration timeline. It can compare the recorded configuration against desired compliance rules (e.g., ensuring a bucket is not public). With AWS Config, you can see exactly when a bucket policy was last changed and what the previous configuration was, making it ideal for auditing and compliance.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat-detection service that uses machine learning and threat intelligence to identify malicious activity, such as unusual API calls, compromised credentials, or crypto mining. It does not log or record configuration changes like S3 bucket policy updates; its purpose is to alert on security threats from network and account activity. GuardDuty might detect an abnormal pattern around a bucket policy change, but it does not provide an audit trail of the change itself.
- ✗
VPC Flow Logs
Why it's wrong here
VPC Flow Logs capture IP traffic information from network interfaces in your VPC, such as source and destination IPs, ports, and protocol. They are used for network diagnostic and security analysis, like identifying heavy traffic or possible DDoS attempts. They do not capture control-plane events or configuration changes, including S3 bucket policy updates, because S3 is a managed service and flow logs only see data-plane traffic to and from VPC resources, not management operations.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is also correct because it records management events, including every API call that modifies S3 bucket policies, such as PutBucketPolicy and DeleteBucketPolicy. It provides a detailed audit log showing who made the change, the source IP address, the time of the change, and the request parameters. This makes CloudTrail a valuable tool for auditing S3 configuration changes, though it focuses on the act of the API call rather than the state of the resource configuration after the call.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.