SCS-C03 Incident Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create an IAM policy in the compromised account to deny CloudTrail deletion.

  Why it's wrong here

  If the attacker has administrative access, they can simply modify or delete any IAM policy you create within that account. An account-level policy does not provide sufficient protection against a compromised administrator role, as the attacker can elevate their own permissions to override or remove local security restrictions.

• ✓

  Use an Service Control Policy (SCP) to deny CloudTrail and log deletion.

  Why this is correct

  SCPs are applied at the Organization or OU level and restrict the permissions of all principals, including administrators within member accounts. By applying an SCP that denies 'cloudtrail:StopLogging' and 's3:DeleteObject', you create a mandatory guardrail that the compromised local administrator cannot override, ensuring logs are preserved for investigation.

• ✗

  Use AWS Config Rules to automatically re-enable CloudTrail if disabled.

  Why it's wrong here

  While AWS Config can trigger remediation, it is reactive rather than preventative. An attacker could still delete logs or stop logging for a period of time before the remediation runs, and they might also have the permissions to disable the Config recorder itself to prevent the remediation from firing.

• ✗

  Enable S3 Object Lock in compliance mode for all log buckets.

  Why it's wrong here

  S3 Object Lock is an excellent control for data integrity, but it does not prevent the attacker from stopping the CloudTrail service or modifying the logging configuration. While it protects existing logs, the attacker could stop the delivery of new logs, resulting in a gap in the audit trail.