SCS-C02 Security Logging and Monitoring Practice Question
A company is using Amazon CloudWatch Logs to store application logs. The security team needs to ensure that logs are encrypted at rest using a customer-managed KMS key (CMK). What configuration is required?
⚠ Common exam trap
Watch out — candidates often confuse the necessary KMS key policy (Option A) with the actual configuration step of associating the key with the log group, or they mistakenly think that encrypting the S3 export destination (Options C or D) encrypts the logs within CloudWatch Logs itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Associate the CMK with the CloudWatch Logs log group by specifying the key ARN in the log group's encryption configuration.
CloudWatch Logs supports server-side encryption with a customer-managed KMS key (CMK) by associating the key ARN with the log group. This is done via the CloudWatch Logs console, AWS CLI, or SDK using the `associate-kms-key` operation, which encrypts all log data at rest within that log group. The KMS key policy must also grant the CloudWatch Logs service principal (`logs.region.amazonaws.com`) permission to use the key, but the core configuration step is associating the key with the log group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a KMS key policy that allows CloudWatch Logs to use the key.
Why it's wrong here
Adding a KMS key policy that grants CloudWatch Logs permission to use the key is a necessary prerequisite, but it does not by itself encrypt any log group. Even after the policy is in place, CloudWatch Logs will continue to use the AWS-managed default encryption key unless you explicitly associate the CMK with a specific log group. The key policy alone cannot force encryption; you must also make the log group use that key.
- ✓
Associate the CMK with the CloudWatch Logs log group by specifying the key ARN in the log group's encryption configuration.
Why this is correct
To encrypt a CloudWatch Logs log group with a customer-managed CMK, you must use the AssociateKmsKey operation (or the console's encryption settings) and pass the key ARN for the log group. Once associated, CloudWatch Logs uses that CMK to encrypt all log data written to the log group. This is the action that actually fulfills the requirement; no other configuration changes the encryption of the log group's stored data.
- ✗
Enable default encryption on the S3 bucket used for log export with a CMK.
Why it's wrong here
Enabling default encryption on an S3 bucket used for log export only protects the objects that result from a CloudWatch Logs export task, such as exports to S3 via the CreateExportTask API. It does not encrypt the log data stored inside CloudWatch Logs itself, because CloudWatch Logs does not store its data in S3; it uses its own internal storage. Thus, this action leaves the original log group unencrypted with a CMK and fails to meet the stated requirement.
- ✗
Configure the S3 bucket policy to require SSE-KMS for log delivery.
Why it's wrong here
Configuring an S3 bucket policy to require SSE-KMS for log delivery governs only how CloudWatch Logs' export task writes objects into that bucket. Since CloudWatch Logs stores log data in its own internal storage, not in S3, and the normal ingestion pipeline never touches the S3 bucket, this bucket policy has no effect on the encryption of log groups. The bucket policy is an operational control for export destinations, not an encryption setting for CloudWatch Logs.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.