SCS-C02 Security Logging and Monitoring Practice Question
A company has a requirement to retain CloudTrail logs for 7 years to meet regulatory compliance. They want to minimize storage costs while ensuring logs are immutable and cannot be deleted by anyone, including the root user. What should they do?
⚠ Common exam trap
It's easy for candidates to confuse S3 Glacier Vault Lock (which applies to Glacier archives, not S3 objects) with S3 Object Lock, or assume MFA Delete provides sufficient immutability, when in fact only S3 Object Lock in Compliance mode guarantees that no user, including root, can delete objects before the retention period ends.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable S3 Object Lock in Compliance mode on the destination bucket.
S3 Object Lock in Compliance mode prevents any user, including the root user, from deleting or overwriting objects for the specified retention period. This meets the immutability and retention requirements for CloudTrail logs, and by using S3 lifecycle policies to transition logs to lower-cost storage classes (e.g., S3 Glacier Deep Archive) after the initial retention period, storage costs can be minimized while maintaining compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the S3 bucket with MFA Delete enabled.
Why it's wrong here
MFA Delete requires multi-factor authentication for permanent deletion of object versions and for toggling the bucket's versioning state, but it does not impose a retention period or a write-once-read-many guarantee. The root user can still disable MFA Delete and purge log objects after satisfying the MFA challenge, so this is a deterrent, not a compliance-grade retention control. Therefore it cannot meet the required seven-year retention.
- ✗
Use CloudTrail log file validation and enable AWS CloudTrail Insights.
Why it's wrong here
CloudTrail log file validation uses SHA-256 hashes to let you verify that log files have not been modified or tampered with after delivery, while CloudTrail Insights analyzes management events for anomalous patterns. Neither feature prevents an IAM principal from deleting S3 objects, nor does either impose a retention window. An attacker with s3:DeleteObject permission can remove logs regardless of validation or Insights status, so the retention requirement remains unfulfilled.
- ✗
Store the logs in Amazon S3 Glacier Deep Archive with a vault lock policy.
Why it's wrong here
S3 Glacier Deep Archive is merely an S3 storage class for infrequently accessed objects; it is not the same as an Amazon S3 Glacier vault, and Vault Lock policies apply only to Glacier vaults, not to S3 buckets. Objects transitioned to the Glacier Deep Archive storage class still live in S3 and are subject to normal S3 delete permissions unless an independent mechanism such as S3 Object Lock is enabled. Thus, this option does not create the immutable retention you need for CloudTrail logs.
- ✓
Enable S3 Object Lock in Compliance mode on the destination bucket.
Why this is correct
Enabling S3 Object Lock in Compliance mode places a retention lock on objects until a specified date; during that retention period no user, not even the AWS account root user, can delete or overwrite them. Compliance mode is the strongest Object Lock mode because the retention protection cannot be shortened, removed, or bypassed by any principal. When used as the destination for CloudTrail logs, this guarantees the logs are retained for the full seven years and satisfies the stated requirement.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.