DOP-C02 Incident and Event Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Amazon CloudWatch Logs

  Why it's wrong here

  Amazon CloudWatch Logs is not the correct service because it serves as a centralized log ingestion and monitoring platform for application logs, system logs, and custom metrics, not as an API activity tracker. Although S3 server access logs can be streamed into CloudWatch Logs, those record client requests to objects (like GET/PUT) and lack the IAM principal identity, source IP, and full request parameters that are needed to determine who performed an administrative API action such as deleting a bucket or modifying its policy. An audit trail of management-plane calls requires CloudTrail, not CloudWatch Logs.

• ✓

  AWS CloudTrail

  Why this is correct

  AWS CloudTrail is the correct answer because it provides a complete audit history of API activity across AWS, including actions performed on S3 buckets such as CreateBucket, PutBucketPolicy, and DeleteBucket. For every management event, CloudTrail captures the IAM user or role, the source IP address, the request parameters, and the response returned, enabling you to answer exactly who did what and when. CloudTrail can also be configured to log data events for object-level S3 operations (GetObject, PutObject) for deeper forensic analysis.

• ✗

  AWS Config

  Why it's wrong here

  AWS Config is incorrect because it focuses on recording resource configuration changes and maintaining a chronological history of those configurations, such as the previous and new values of an S3 bucket policy. While Config can detect that a change occurred and even create a configuration item, it does not attribute that change to a specific IAM principal; the identity information is only available in the CloudTrail event that accompanies the change. Config is a configuration management and compliance tool, not an API call logger.

• ✗

  Amazon GuardDuty

  Why it's wrong here

  Amazon GuardDuty is incorrect because it is a threat detection service that uses existing log sources, including CloudTrail event history, VPC Flow Logs, and DNS logs, to identify malicious activity and anomalies. It does not generate its own API call audit log; rather, it consumes CloudTrail data and provides findings when it detects unusual behavior, such as a user accessing an S3 bucket from an anomalous location. To retrieve a definitive record of who performed a specific API action, you would still need to query CloudTrail directly, not GuardDuty.

Go deeper

Related to this question