SCS-C02 Security Logging and Monitoring Practice Question
A company uses Amazon S3 to store sensitive data. The security team needs to be alerted when an S3 bucket policy is changed to allow public access. Which combination of services should be used to meet this requirement?
⚠ Common exam trap
Many candidates choose AWS CloudTrail (Option A) because it logs API calls like PutBucketPolicy, but they overlook that CloudTrail alone cannot evaluate the policy content for public access or trigger alerts without additional services like EventBridge and Lambda, whereas AWS Config is purpose-built for continuous compliance monitoring and alerting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config with AWS Lambda and Amazon Simple Notification Service (SNS)
AWS Config can monitor S3 bucket policies for changes that grant public access using a managed rule like 's3-bucket-public-read-prohibited' or a custom Lambda function. When a noncompliant change is detected, AWS Config can invoke an AWS Lambda function to evaluate the policy and publish a notification to Amazon SNS, alerting the security team. This combination provides real-time, policy-driven monitoring and alerting for public access changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudTrail and Amazon Simple Notification Service (SNS)
Why it's wrong here
CloudTrail records the PutBucketPolicy API call as a control-plane event in its event history, but CloudTrail is an audit log, not a real-time event router. It delivers logs to an S3 bucket or CloudWatch Logs, and it does not natively invoke an SNS topic for each bucket policy change. To alert on the event you would need an Amazon EventBridge rule or a CloudWatch Logs subscription filter, so pairing CloudTrail and SNS alone does not satisfy the requirement.
- ✗
S3 server access logs and Amazon Athena
Why it's wrong here
S3 server access logs capture object-level requests such as GET, PUT, and DELETE against objects, not control-plane API calls like PutBucketPolicy. A bucket policy change is therefore absent from these logs, so Amazon Athena queries would never surface the modification. Even if the logs did contain relevant data, they are delivered on a best-effort basis with variable delays, making them unsuitable for real-time notification.
- ✗
AWS Trusted Advisor and Amazon Simple Notification Service (SNS)
Why it's wrong here
Trusted Advisor runs periodic checks—typically refreshed on a daily schedule—and its S3 permission checks are designed to flag publicly accessible buckets, not to detect every policy edit at the moment it occurs. Its SNS notifications are tied to overall check status changes or weekly digests, not to individual PutBucketPolicy events. Thus Trusted Advisor and SNS could eventually alert on a risky bucket configuration, but they cannot provide the real-time, change-triggered alerting described in the requirement.
- ✓
AWS Config with AWS Lambda and Amazon Simple Notification Service (SNS)
Why this is correct
AWS Config can continuously record configuration changes to an S3 bucket policy and evaluate those changes against a managed or custom rule. When a PutBucketPolicy event occurs, AWS Config marks the configuration item as changed and invokes a custom Lambda function, which can in turn publish a message to an SNS topic to notify security teams. This design provides real-time detection and alerting because the Lambda function is triggered by the configuration change, not by a periodic scan.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.