DOP-C02 Incident and Event Response Practice Question
An organization uses AWS Systems Manager to manage its EC2 instances. After a security incident, the security team wants to ensure that all future API calls to Systems Manager are logged and monitored. What is the MOST efficient way to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable AWS CloudTrail for the Systems Manager service
Enabling CloudTrail for Systems Manager logs all API calls made to the Systems Manager service. Option A is incorrect because S3 server access logging only logs access to S3 buckets, not Systems Manager API calls. Option C is incorrect because the CloudWatch Logs agent captures instance logs, not API calls to Systems Manager. Option D is incorrect because AWS Config rules track configuration changes, not API calls. Therefore, CloudTrail is the most efficient way to log and monitor all future API calls to Systems Manager.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable S3 server access logging on the Systems Manager log bucket
Why it's wrong here
S3 server access logging records every request made against an S3 bucket, such as PUT, GET, or DELETE operations, but it has no visibility into Systems Manager (SSM) control-plane activity. Because SSM API calls like SendCommand or StartSession are not S3 object operations, this log type cannot provide an audit trail of who invoked an SSM operation. Even if SSM output is stored in that bucket, the server access logs only show object access, not the SSM API invocation itself.
- ✓
Enable AWS CloudTrail for the Systems Manager service
Why this is correct
AWS CloudTrail is the authoritative service for auditing API calls, and it natively records Systems Manager management events such as SendCommand, RunCommand, and StartSession. When a trail is enabled (or via the default event history), each event includes the IAM principal, source IP address, event time, request parameters, and response elements, yielding a complete 'who did what' record. This is precisely what is needed to audit and govern SSM usage across an EC2 fleet.
- ✗
Install the CloudWatch Logs agent on each instance to capture Systems Manager logs
Why it's wrong here
The CloudWatch Logs agent (or unified agent) only ingests log files generated by the operating system or applications running on each EC2 instance, such as /var/log/messages or web server logs. It does not intercept or record SSM API calls made against the AWS control plane, and it cannot attribute an SSM action to a particular IAM user. While SSM itself can optionally stream session output or command results to CloudWatch Logs for operational visibility, that does not replace the API-level audit trail that CloudTrail provides.
- ✗
Create an AWS Config rule to monitor Systems Manager usage
Why it's wrong here
AWS Config evaluates resource configurations against rules, capturing snapshots and changes such as whether an EC2 instance has the SSM agent installed or whether instance tags are compliant. It does not record discrete API invocations, so a Config rule cannot answer 'who issued this SSM automation' or 'when was this RunCommand executed'. Config is a configuration management and compliance tool, not an API activity auditor; monitoring SSM usage through Config would reveal state drift but not the identity or event history of SSM calls.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.