DOP-C02 Incident and Event Response Practice Question
A DevOps team is investigating a security incident where an unauthorized user accessed an S3 bucket. The team needs to determine what actions were taken by the user. Which TWO AWS services should be used together to investigate? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
S3 server access logs
S3 server access logs (A) are correct because they record detailed, object-level requests made against a bucket, including the requester, bucket name, request time, action (such as REST.GET.OBJECT or REST.PUT.OBJECT), response status, and error code, which lets the team see exactly what operations the unauthorized user performed on the objects. AWS CloudTrail (D) is correct because it captures S3 data events (GetObject, PutObject, DeleteObject) and management events (such as PutBucketPolicy) as API activity with the identity of the caller, source IP address, and timestamp, providing the who-did-what audit trail needed to attribute the actions. Used together, CloudTrail identifies the principal and API calls while S3 server access logs provide the granular request-level detail for the bucket. Amazon CloudWatch metrics (B) only provides aggregate performance and usage statistics, not per-request identity or action detail, so it cannot show what the user did. AWS Config (C) tracks resource configuration changes and compliance over time, not individual object access actions. Amazon GuardDuty (E) is a threat-detection service that generates findings about suspicious activity but does not provide the raw request-level or API-level audit records required to reconstruct the user's actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
S3 server access logs
Why this is correct
S3 server access logs record every request made to a bucket, capturing the authenticated identity, timestamp, source IP and operation performed. This directly satisfies the requirement to determine which actions the unauthorised user took, since the logs detail the specific REST operations against the bucket.
- ✗
Amazon CloudWatch metrics
Why it's wrong here
CloudWatch metrics record aggregate counts and latency, not the API calls an identity made, so they cannot reconstruct the attacker's actions. They tempt because S3 request metrics reveal access volume and error spikes, which suits detecting anomalous traffic rather than attributing specific actions.
- ✗
AWS Config
Why it's wrong here
AWS Config records resource configuration changes and compliance state, not the API actions a principal performed against objects. It tempts because it tracks S3 bucket policy and ACL modifications over time, which suits auditing configuration drift rather than reconstructing an intruder's data-plane activity.
- ✓
AWS CloudTrail
Why this is correct
CloudTrail records the API activity, capturing which identity made which S3 requests, from where, and when. It supplies the action-level detail needed to reconstruct the unauthorised user's activity, which is the investigative requirement in the stem.
- ✗
Amazon GuardDuty
Why it's wrong here
GuardDuty produces findings from threat intelligence and anomaly detection; it flags suspicious behaviour but does not log the individual API calls made. It tempts because it surfaces the unauthorised access itself, which suits alerting and triage rather than determining exactly which actions followed.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A DevOps engineer is investigating a security incident where an unauthorized user accessed an S3 bucket containing sensitive data. The engineer needs to determine what actions the user performed and from which IP address. Which AWS service should be used to retrieve this information?
medium- A.AWS CloudTrail management events.
- B.Amazon Inspector findings.
- ✓ C.Amazon S3 server access logs.
- D.Amazon CloudWatch Logs for the S3 bucket.
Why C: Amazon S3 server access logs record detailed information about every request made to a bucket, including the requester's IP address, the action performed (GET, PUT, DELETE), the object accessed, and the timestamp. This is the only option that provides both the actions performed and the source IP for object-level access. CloudTrail management events do not capture S3 data-plane operations like GetObject.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.