Encrypt and Audit Centralized Logging — KMS and CloudTrail Data Events | AWS Security Specialty
A company is designing a centralized logging solution for multiple AWS accounts. The logs must be encrypted at rest and in transit, and access must be audited. Which TWO actions should be taken? (Choose TWO.)
Quick Answer
The correct answer is to use AWS KMS customer managed keys (CMK) to encrypt the central S3 bucket and apply an S3 bucket policy with a condition for aws:SourceArn. This combination ensures logs are encrypted at rest using a key you control, while the bucket policy restricts write access exclusively to the intended CloudTrail trail, preventing unauthorized log injection. For encryption in transit, CloudTrail automatically uses TLS when delivering logs to S3, so no additional configuration is needed. On the AWS Certified Security Specialty SCS-C02 exam, this question tests your understanding of centralized logging audit controls, specifically how KMS integrates with CloudTrail data events to log every key usage, and how resource-based policies enforce cross-account trust. A common trap is confusing S3 access logs (which track requests to the bucket) with encryption mechanisms, or assuming CloudWatch Logs supports native cross-account subscriptions without extra setup. Memory tip: “KMS for the key, SourceArn for the source” — encryption and authorization are two separate actions that together secure centralized logging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the S3 bucket policy to restrict PutObject to the CloudTrail service principal with a condition on aws:SourceArn.
To centrally aggregate logs from multiple AWS accounts while ensuring encryption at rest and in transit, and auditing access, two key actions are required. First, configure the central S3 bucket with a bucket policy that restricts PutObject to the CloudTrail service principal with a condition on aws:SourceArn (Option C). This ensures only the intended CloudTrail trails from designated accounts can write logs, providing security and auditability. Second, use AWS KMS customer managed keys (CMK) to encrypt the central S3 bucket (Option D). This gives you control over the encryption keys and enables auditing of key usage via CloudTrail. Option A is incorrect because cross-account CloudWatch Logs subscription requires additional configuration and does not inherently provide encryption at rest with KMS control. Option B is wrong because enabling S3 server access logs does not encrypt the logs nor restrict write access; it logs access to the bucket itself. Option E is incorrect because VPC endpoints ensure traffic stays within the AWS network but do not provide encryption at rest or the granular write restrictions needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure cross-account CloudWatch Logs subscription to aggregate logs centrally.
Why it's wrong here
Cross-account CloudWatch Logs subscription can aggregate logs, but it does not provide encryption at rest with KMS or the fine-grained write restrictions offered by bucket policies with SourceArn; also, it requires additional setup and is not the best practice for this requirement.
- ✗
Enable S3 server access logs on the central bucket for auditing.
Why it's wrong here
Enabling S3 server access logs creates access logs for the bucket, but these logs do not encrypt the central bucket's contents nor restrict write access; they are for auditing access to the bucket itself, not for the logging solution.
- ✓
Configure the S3 bucket policy to restrict PutObject to the CloudTrail service principal with a condition on aws:SourceArn.
Why this is correct
Correct. A bucket policy with PutObject restricted to the CloudTrail service principal and a condition on aws:SourceArn ensures only authorized CloudTrail trails can deliver logs, providing secure aggregation and auditability.
- ✓
Use AWS KMS customer managed keys (CMK) to encrypt the central S3 bucket.
Why this is correct
Correct. Using AWS KMS CMK to encrypt the central S3 bucket provides control over encryption keys and allows auditing of key usage via CloudTrail, meeting the encryption at rest and auditing requirements.
- ✗
Use VPC endpoints to ensure logs are transmitted over the AWS network.
Why it's wrong here
VPC endpoints keep traffic within the AWS network, which helps with encryption in transit, but they do not address encryption at rest or the write restrictions needed for secure log aggregation.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer is configuring a centralized logging solution for multiple AWS accounts. The engineer needs to ensure that log files are encrypted at rest and that access to the logs is audited. Which combination of services and features should be used?
hard- A.Use S3 SSE-S3 and enable S3 access logs.
- B.Use AWS KMS to encrypt the logs before uploading to S3.
- C.Use S3 SSE-C and enable CloudTrail for S3 data events.
- ✓ D.Use S3 SSE-KMS and enable CloudTrail for S3 data events.
Why D: It uses S3 SSE-KMS to encrypt log files at rest with AWS KMS, providing centralized key management and fine-grained access control. Enabling CloudTrail for S3 data events (e.g., GetObject, PutObject) ensures that every access to the logs is audited, meeting both encryption and audit requirements.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.