SCS-C02 Threat Detection and Incident Response Practice Question

A company has a security rule that all S3 buckets must have server access logging enabled. A security engineer uses AWS Config to evaluate compliance. The engineer configures a managed rule but notices that the rule does not evaluate all buckets. What is the most likely reason?

⚠ Common exam trap

Watch out — candidates often assume AWS Config managed rules evaluate all resources of a given type by default, overlooking the fact that many rules support optional tag-based filtering that can silently limit the scope of evaluation.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The rule only evaluates buckets that have a specific tag.

The AWS Config managed rule `s3-bucket-server-access-logging-enabled` can be configured with a `tag` parameter. When a tag is specified, the rule only evaluates S3 buckets that have that exact tag key-value pair. If the security engineer did not apply the required tag to all buckets, or if the rule was configured with a tag that does not match all buckets, some buckets will be excluded from evaluation, causing the observed behavior.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The rule only evaluates buckets in the us-east-1 region.
Why it's wrong here
The AWS Config managed rule `s3-bucket-server-access-logging-enabled` is not inherently restricted to the us-east-1 region. AWS Config is deployed regionally and records S3 bucket configurations in every region where it is enabled, and the rule can be scoped to evaluate resources across all supported regions. While a bucket has a home region, the rule's evaluation scope is determined by the rule's configuration (e.g., resource type and tags), not by a default region limitation. If an engineer sees only us-east-1 buckets evaluated, it is because AWS Config is likely only enabled in that region, not because the rule itself is region-bound.
✓
The rule only evaluates buckets that have a specific tag.
Why this is correct
The AWS Config managed rule `s3-bucket-server-access-logging-enabled` can be configured with a `tag` parameter. When a tag is specified, the rule only evaluates S3 buckets that have that exact tag. If the engineer did not apply the required tag to all buckets, or if the rule was configured with a tag that does not match all buckets, some buckets will be excluded.
✗
The rule excludes buckets that have a bucket policy denying access to AWS Config.
Why it's wrong here
Bucket policies that deny access to AWS Config would prevent Config from recording the bucket's configuration, but the rule evaluation itself is not affected by such policies. The rule would still attempt to evaluate the bucket, but might fail due to access denial, not silently exclude it.
✗
The rule requires the logging target bucket to be in the same account.
Why it's wrong here
The rule simply verifies that the source bucket has server access logging enabled by checking the bucket's logging configuration, which contains a target bucket name and prefix. S3 server access logging fully supports cross-account targets: the target bucket can belong to a different AWS account provided the target bucket policy grants `s3:PutObject` permission to the S3 log delivery group. The managed rule does not inspect account ownership of the target bucket and does not require the source and target to be in the same account; so if a bucket is logging to an external target with valid permissions, the rule will still mark it compliant.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Threat Detection and Incident Response Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question