SCS-C03 Incident Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  CloudTrail Data Events

  Why this is correct

  CloudTrail Data Events capture object-level API operations like GetObject, PutObject, and DeleteObject. These logs are crucial for identifying exactly which files were accessed or modified by an attacker, as standard management events do not track data-plane operations for S3 buckets.

• ✓

  VPC Flow Logs

  Why this is correct

  If the S3 access occurred through a VPC Interface Endpoint, VPC Flow Logs provide evidence of the network connection between the EC2 instance and the S3 service. This helps verify the volume of data transferred and the network path taken by the exfiltrated objects.

• ✗

  AWS WAF Logs

  Why it's wrong here

  AWS WAF logs monitor traffic for web applications (HTTP/HTTPS) and are typically not involved in direct S3 bucket API calls unless the request is proxied through a web server. They would not provide visibility into direct S3 API requests made by IAM roles or users.

• ✓

  S3 Server Access Logs

  Why this is correct

  S3 Server Access Logs provide detailed records for requests made to a bucket. They are a valuable supplement to CloudTrail, as they include fields like remote IP, request time, and HTTP status codes, helping to distinguish between successful and failed access attempts during an exfiltration event.

• ✗

  AWS Trusted Advisor reports

  Why it's wrong here

  Trusted Advisor provides recommendations on optimization and security posture, such as identifying public buckets or open ports. It does not provide real-time logs or forensic data regarding specific object access or data transfer activity, making it irrelevant for tracking an active data exfiltration incident.