DOP-C02 Incident and Event Response Practice Question
A security team is investigating a potential data exfiltration from an S3 bucket. They need to identify which IAM user accessed a specific object and whether the access was from a known IP address. Which THREE AWS services or features should they use together to conduct this investigation?
⚠ Common exam trap
The trap is selecting VPC Flow Logs or AWS Config because they sound like network/audit tools — but Flow Logs lack IAM identity and object names, and Config tracks configuration not access events, so neither can answer 'which IAM user accessed this object from which IP.'
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail (C) is correct because it records S3 data-plane API calls such as GetObject, including the IAM identity (user or role) that made the request, the source IP address, and the timestamp, which directly answers who accessed the object and from where. S3 server access logs (D) are correct because they provide detailed, object-level records for every request against the bucket, including the requester, source IP, request URI, and HTTP status, giving a second authoritative source for the specific object access. Amazon Athena (E) is correct because it lets the team query CloudTrail logs and S3 access logs stored in S3 using standard SQL, so they can efficiently correlate the IAM user, object key, and source IP across large log datasets. AWS Config (A) is not appropriate because it tracks resource configuration changes and compliance, not individual object access events or source IPs. VPC Flow Logs (B) capture IP traffic metadata at the ENI/subnet level and do not identify IAM users or S3 object-level requests, so they cannot answer who accessed the object.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config records resource configuration state and changes over time—such as bucket policies, lifecycle rules, and encryption settings—and evaluates them against compliance rules. It does not capture data plane activity, so an object's contents being read or copied would not generate a Config record. Thus, AWS Config cannot identify who exfiltrated data or what objects were accessed.
- ✗
VPC Flow Logs
Why it's wrong here
VPC Flow Logs capture IP traffic metadata at the network interface level—source/destination IPs, ports, protocols, and packet/byte counts—but they contain no application-layer payload or S3 object identifiers. An S3 GetObject request occurs over HTTPS, and the flow log would only show a TLS connection to the S3 endpoint, not which bucket or key was accessed. Therefore, VPC Flow Logs cannot substantiate data exfiltration from S3.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is correct for this investigation because it records S3 data-plane API calls such as GetObject, PutObject, and ListObjects, along with the requesting IAM identity, source IP, and timestamp. Object-level logging must be enabled on the trail or bucket, but once active, it provides a comprehensive audit trail of exactly which objects were retrieved. This makes CloudTrail a primary evidence source for S3 data exfiltration.
- ✓
S3 server access logs
Why this is correct
S3 server access logs are a direct account-level source of object-level activity, capturing every request made to a bucket with fields for bucket name, object key, requester, action (e.g., REST.GET.OBJECT), HTTP status, and bytes transferred. These logs are delivered to a target S3 bucket and can be queried for forensic pattern detection, such as a single principal downloading a large number of keys in a short window. Unlike CloudTrail, these logs are generated by the S3 service itself and reflect physical access-layer events.
- ✓
Amazon Athena
Why this is correct
Amazon Athena is a serverless SQL query engine that directly queries structured, semi-structured, or unstructured data stored in S3, including CloudTrail logs, S3 server access logs, and VPC Flow Logs. It enables investigators to run ad-hoc analytics without provisioning infrastructure, for example, grouping by principal or object key to identify a bulk-download anomaly. Athena is a valid tool in this investigation, though it is an analysis layer rather than a logging source.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,298 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.