Based on the exhibit, the security team needs to detect and alert on both successful and failed attempts to change S3 bucket policies and KMS key policies across the organization. Which solution best meets that requirement?

Enable AWS Config in all accounts and use only a periodic compliance evaluation to alert when bucket or key policies drift.

AWS Config is useful for detecting configuration drift, but it is not the best tool for alerting on every policy-change attempt, especially failed API calls. The requirement explicitly asks for attempts and timely alerting, which CloudTrail and EventBridge handle more directly.

Use IAM Access Analyzer because it continuously blocks policy changes that would expose the resources publicly.

Access Analyzer can identify broad resource-access patterns and generate findings, but it does not block or alert on every bucket policy or KMS key policy API call. It is not a real-time audit trail for successful and failed administrative actions.

Turn on S3 server access logging and KMS key rotation, because both services will capture policy modifications automatically.

S3 server access logging records object-level access to buckets, not administrative policy changes. KMS key rotation changes cryptographic material, not audit coverage for policy updates. Neither service alone satisfies the requirement to alert on policy-change attempts across the organization.

What does this SAA-C03 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Enable an organization trail for management events in all regions and create an EventBridge rule that matches PutBucketPolicy and PutKeyPolicy, then send alerts to SNS. — The strongest detective control is an organization-wide CloudTrail trail with management events enabled in all Regions, paired with an EventBridge rule that matches the relevant API names. CloudTrail records both successful and denied administrative calls, so you can alert on attempted and completed changes. Sending the matched events to SNS gives the security team immediate notification without relying on periodic scans. AWS Config is useful for drift and compliance, but it is not the primary alert mechanism for API attempts. Access Analyzer is for exposure analysis, not real-time auditing. S3 server access logs and KMS rotation do not capture policy-change operations. The requirement is about detective controls for admin actions, so CloudTrail plus EventBridge is the correct answer.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.