SCS-C02 Security Logging and Monitoring Practice Question
A company uses AWS CloudTrail to log all API activity. A security analyst notices that some delete operations on S3 buckets are missing from the CloudTrail logs. What is the MOST likely reason?
⚠ Common exam trap
Watch out — candidates often assume CloudTrail logs all API activity by default, failing to distinguish between management events and data events, which require separate configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The trail is configured to log only management events, not data events.
CloudTrail trails can be configured to log management events (control plane operations like CreateBucket) and/or data events (data plane operations like GetObject, DeleteObject). By default, a trail logs only management events. S3 delete operations on objects within a bucket are data events, so if the trail is not configured to log data events, those delete operations will not appear in CloudTrail logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The S3 bucket has server access logging enabled, which overrides CloudTrail.
Why it's wrong here
S3 server access logging is an independent bucket-level feature that logs HTTP requests made to a bucket, such as object GETs and DELETEs, but it never alters or suppresses what CloudTrail delivers. CloudTrail has its own event selector configuration, so enabling or disabling server access logging has no effect on whether data events appear in a trail. Thus, if DeleteObject calls are missing from CloudTrail, the cause must be the trail's event selector, not server access logs.
- ✓
The trail is configured to log only management events, not data events.
Why this is correct
A CloudTrail trail defaults to recording only management events, which cover control-plane operations such as creating or deleting buckets, not data-plane operations like deleting objects within an S3 bucket. Object-level S3 activities, including DeleteObject and PutObject, are classified as data events and must be explicitly enabled using data event selectors in the trail configuration. Since only management events are being logged, the DeleteObject API calls will not appear in CloudTrail event history, matching the scenario exactly.
- ✗
The delete operations are performed by a cross-account role, which CloudTrail does not log.
Why it's wrong here
Cross-account API activity is not ignored by CloudTrail; when a role from another account is assumed, the resulting S3 deletion is logged under the assumed-role principal in the account where the action occurred. CloudTrail records the userIdentity with the session name and account ID for cross-account roles, provided the trail has the appropriate event types enabled and the logs are delivered to a location the account can access. The absence of these entries is therefore attributable to event selector configuration, not to the use of a cross-account role.
- ✗
The root user of the account is excluded from CloudTrail logging.
Why it's wrong here
CloudTrail is designed to record activities performed by the root user just like any other IAM principal, and there is no setting that excludes the root user from logging. In fact, root user actions are considered important for security review and are included by default in management event history. If the root user performed the delete using an API call, it would appear in CloudTrail, so root user exclusion cannot be the reason for the missing event.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.