CloudTrail Log Immutability with S3 Object Lock
A company uses AWS CloudTrail to log all API activity and delivers logs to an S3 bucket with server-side encryption (SSE-S3). The security team needs to ensure that only authorized personnel can access the logs and that any unauthorized access attempts are logged and alerted. Additionally, the team wants to prevent the logs from being deleted for at least one year. Which combination of actions should be taken?
Quick Answer
This combination works because the scenario bundles three distinct requirements into one question, and each maps to a different, purpose-built control. S3 Object Lock with a one-year retention period enforces a write-once-read-many model at the storage layer, so no principal, not even an account owner, can delete or overwrite the CloudTrail log objects before the retention period expires, directly satisfying the deletion-prevention requirement. S3 server access logging separately records every request made against the bucket, successful or not, giving the security team the raw data needed to identify and alert on unauthorized access attempts. The bucket policy with a condition limiting access to specific authorized IAM roles or users is what actually restricts who can reach the bucket, turning the access logs from passive records into a meaningful control once paired with real access restriction. None of these three controls substitutes for another: locking prevents deletion but does not restrict who can read the logs, restricting access does not itself create an audit trail, and logging access does not stop anyone from deleting objects. Whenever a question lists several distinct outcomes in one scenario, such as retention, access restriction, and monitoring of unauthorized attempts, expect the answer to be a combination where each piece addresses exactly one outcome rather than a single all-purpose service.
⚠ Common exam trap
Many candidates confuse S3 default encryption with data retention controls, or assume that CloudTrail logging of S3 API calls is sufficient to capture unauthorized access attempts, when in fact S3 server access logs are needed for request-level logging of denied operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable S3 Object Lock with a retention period of one year; enable S3 server access logs; use a bucket policy with a condition that allows access only from authorized IAM roles or users.
S3 Object Lock with a retention period of one year enforces a write-once-read-many (WORM) model, preventing any deletion or overwrite of log objects for that duration. S3 server access logs capture detailed records of all requests made to the bucket, including unauthorized access attempts, which can be used for alerting. The bucket policy with a condition restricting access to authorized IAM roles or users ensures that only permitted principals can access the logs, meeting the security team's requirements for access control, logging of unauthorized attempts, and deletion prevention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable S3 Object Lock with a retention period of one year; enable S3 server access logs; use a bucket policy with a condition that allows access only from authorized IAM roles or users.
Why this is correct
Object Lock prevents deletion; server access logs record all requests; bucket policy with conditions restricts access.
- ✗
Enable S3 default encryption (SSE-S3) on the bucket; enable S3 server access logs; attach an IAM policy that allows only authorized users to access the bucket.
Why it's wrong here
SSE-S3 does not prevent deletion; server access logs record requests but not unauthorized access attempts specifically; IAM policies alone may not restrict access if bucket policies are permissive.
- ✗
Enable MFA Delete on the bucket; enable CloudTrail log file validation; use bucket ACLs to restrict access.
Why it's wrong here
MFA Delete prevents deletion but requires multi-factor authentication; CloudTrail log file validation ensures integrity but does not prevent deletion; ACLs are not recommended.
- ✗
Enable S3 Inventory to track objects; enable CloudTrail to log S3 API calls; use a bucket policy with a deny effect for unauthorized users.
Why it's wrong here
Inventory does not prevent deletion; CloudTrail logs API calls but does not prevent deletion; deny policies can restrict access but Object Lock is more effective for preventing deletion.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS CloudTrail to log all API activity. The security team wants to ensure that logs are immutable after they are delivered to Amazon S3. Which combination of actions should be taken to meet this requirement? (Choose the best single answer that includes all necessary steps.)
hard- ✓ A.Enable S3 Object Lock in governance mode on the bucket.
- B.Enable MFA Delete on the bucket.
- C.Enable versioning on the bucket.
- D.Create a bucket policy that denies s3:DeleteObject actions.
Why A: S3 Object Lock in governance mode prevents objects from being deleted or overwritten by any user, including the root user, for a specified retention period. This ensures immutability of CloudTrail logs after delivery, meeting the security team's requirement. Governance mode allows authorized users to shorten retention periods or remove locks if needed, but by default it enforces write-once-read-many (WORM) protection.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.