SCS-C03 Detection Practice Question
A financial institution requires that all CloudTrail logs be stored for seven years for compliance audits. They also need the ability to run complex SQL queries against these logs to identify specific user actions across all regions. What is the most cost-effective and operationally simple solution?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use CloudTrail Lake to create an event data store with a seven-year retention period.
CloudTrail Lake is a managed data lake that simplifies the storage and analysis of CloudTrail events. It eliminates the need to build complex ETL pipelines between S3, Glue, and Athena. It provides a built-in SQL query engine and supports long-term retention policies suitable for compliance requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store logs in an S3 bucket and use Amazon Athena to run SQL queries.
Why it's wrong here
While this solution works, it requires managing S3 lifecycle policies, Glue Crawlers, and Athena table schemas. This introduces more operational overhead compared to CloudTrail Lake, which is a purpose-built, managed solution for storing and querying CloudTrail data with minimal configuration.
- ✓
Use CloudTrail Lake to create an event data store with a seven-year retention period.
Why this is correct
CloudTrail Lake allows for the creation of an event data store that natively handles ingestion, storage, and querying. It supports the required seven-year retention and provides a familiar SQL interface, making it the most streamlined option for long-term compliance and ad-hoc security investigations.
- ✗
Stream logs to Amazon OpenSearch Service for real-time indexing and visualization.
Why it's wrong here
Amazon OpenSearch is excellent for real-time search and visualization but is significantly more expensive for seven-year data retention. Managing a large OpenSearch cluster for long-term storage is operationally complex and not as cost-effective as using a dedicated data lake like CloudTrail Lake.
- ✗
Enable CloudWatch Logs for CloudTrail and use Logs Insights for querying.
Why it's wrong here
CloudWatch Logs is designed for short-term log analysis and alerting. While Logs Insights is powerful, CloudWatch Logs storage costs are much higher than S3 or CloudTrail Lake for seven-year retention, making this an expensive and suboptimal choice for long-term compliance storage.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.