Enable AWS Config delivery to a separate bucket and create a rule to detect noncompliant S3 policies; this will automatically generate GetObject logs.

AWS Config evaluates resource configuration and policy compliance, but it does not provide object-level access logs like GetObject and PutObject. The requirement is detective visibility into access and writes, not configuration drift detection. This approach would not fill the logging gap for exfiltration investigations.

Turn on VPC Flow Logs for the VPC hosting the S3 gateway endpoint, because network logs show S3 object read and write details.

VPC Flow Logs capture network traffic metadata (e.g., src/dst IPs and ports) but not S3 API actions at the object level. They cannot directly answer which objects were read from or written to within the bucket. The symptom is missing CloudTrail visibility into object-level operations, not network reachability.

Add an S3 bucket policy that denies all GetObject requests unless the caller uses TLS; the denial events will create investigation logs automatically.

A bucket policy denial will generate some logs, but it does not provide comprehensive object access visibility for legitimate reads and writes. Additionally, enforcement does not equal detective coverage; you may still miss successful access events. The question asks for configuration to provide missing object-level logs.

What does this SAA-C03 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Enable CloudTrail data events for the specific S3 bucket so that GetObject and PutObject operations are logged at the object level. — The symptom (CloudTrail management events enabled but no GetObject/PutObject visibility) indicates the team is missing CloudTrail data events for S3. Management events log actions like CreateBucket and PutBucketPolicy, while object-level reads/writes require S3 data events, which record per-request object operations such as GetObject and PutObject. Enabling CloudTrail data events for the specific bucket (and optionally prefixes) provides the detailed access history needed for exfiltration investigations and for confirming when encrypted objects were written. Why others are wrong: Option B is incorrect because AWS Config detects configuration compliance and policy changes, not per-object data access. Option C is incorrect because VPC Flow Logs are network-level and do not reveal S3 object keys or API actions. Option D is incorrect because bucket policy enforcement may block some access and can generate limited denial signals, but it does not substitute for comprehensive object-level logging of successful reads and writes.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.