SCS-C02 Security Logging and Monitoring Practice Question
A company uses AWS CloudTrail and wants to ensure that logs are encrypted at rest using a customer-managed KMS key. The CloudTrail trail is configured to deliver logs to an S3 bucket. After enabling SSE-KMS on the S3 bucket, the logs are not being delivered. What is the most likely cause?
⚠ Common exam trap
Many candidates assume enabling SSE-KMS on the S3 bucket is sufficient, overlooking that CloudTrail must also be explicitly authorized in the KMS key policy to use the key for encryption operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The KMS key policy does not grant CloudTrail permission to use the key.
CloudTrail requires explicit permissions in the KMS key policy to use the key for encrypting log files. Even if SSE-KMS is enabled on the S3 bucket, CloudTrail must have `kms:GenerateDataKey` and `kms:Decrypt` permissions granted via the key policy. Without these, CloudTrail cannot encrypt the logs, causing delivery to fail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CloudTrail does not support SSE-KMS.
Why it's wrong here
This statement is factually incorrect. AWS CloudTrail fully supports server-side encryption with AWS KMS-managed keys (SSE-KMS). When you configure CloudTrail to encrypt your log files, you can specify a customer managed key (CMK) or use the default aws/cloudtrail managed key. Therefore, claiming CloudTrail does not support SSE-KMS is not a valid reason for logs not being encrypted.
- ✗
The KMS key is in a different AWS account.
Why it's wrong here
CloudTrail does support using a customer managed KMS key from a different AWS account. For cross-account delivery, you must configure the KMS key policy to allow the CloudTrail service principal from the logging account, and the S3 bucket policy must also permit access. Merely having the key in a different account does not prevent CloudTrail from using it, so this is not inherently the cause of an encryption failure.
- ✗
The S3 bucket policy does not allow CloudTrail to write logs.
Why it's wrong here
While an S3 bucket policy that denies CloudTrail write access would absolutely prevent log delivery, it is not the reason for encryption problems. If logs are being delivered successfully to the bucket but are not encrypted with the expected KMS key, the issue would lie instead in the KMS key policy or the CloudTrail configuration. This option is incorrect because it describes a delivery failure, not an encryption configuration failure.
- ✓
The KMS key policy does not grant CloudTrail permission to use the key.
Why this is correct
For CloudTrail to encrypt log files with a customer managed KMS key, the key policy must grant the CloudTrail service principal (cloudtrail.amazonaws.com) permissions for kms:GenerateDataKey and kms:Decrypt. If these permissions are missing, CloudTrail cannot generate the data key needed to encrypt the logs, and log delivery will fail or produce unencrypted logs. This is the exact cause described in the question, making it the correct answer.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.