Your security team needs to detect and alert on any attempt to change sensitive policies, specifically S3 bucket policy changes and KMS key policy changes. The team wants alerts within minutes, and logs must be centrally retained for forensics. Which design best meets these detective control requirements using AWS-native services?

Rely on AWS Config resource snapshots only; use the snapshots to infer policy changes and generate alerts from the daily compliance summary reports.

Config summaries are not designed for rapid alerting and may miss timely detection windows. Snapshots alone are not as direct as API-call based detection.

Enable S3 access logging on the affected buckets only; treat these logs as sufficient evidence for KMS key policy modifications.

S3 access logs focus on object and bucket request activity, not KMS key policy API changes. KMS policy changes are not represented reliably in S3 access logs.

Turn on CloudWatch Logs for the S3 bucket and KMS key; alert on any log line containing the word 'policy' to detect changes.

CloudWatch Logs won’t automatically capture KMS or S3 policy-change API events as structured audit events. Keyword matching is unreliable and may miss changes.

What does this SAA-C03 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Enable CloudTrail management events and configure an EventBridge rule to send notifications for PutBucketPolicy and PutKeyPolicy API calls, while also delivering CloudTrail logs to a dedicated S3 bucket for retention. — The most reliable way to detect sensitive policy changes is to use CloudTrail management events because they record control-plane API calls such as PutBucketPolicy and PutKeyPolicy. To achieve near-real-time alerts, route those events to EventBridge rules that trigger notifications within minutes. For centralized forensic retention, configure CloudTrail to deliver logs to a dedicated S3 bucket (optionally with lifecycle policies and encryption). This combination provides both timely detection and durable audit evidence tied to the exact API operations and principals. Option B relies on AWS Config summaries, which are typically periodic and compliance-oriented rather than direct near-real-time alerts for specific policy-change API calls. Option C misuses S3 access logs; those logs do not provide authoritative coverage of KMS key policy changes. Option D is not robust because CloudWatch Logs generally requires explicit application or service log sources; policy-change detection via keyword matching can be incomplete and non-auditable.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.