SCS-C02 Security Logging and Monitoring Practice Question
A company uses AWS CloudTrail to log all API calls across multiple accounts in AWS Organizations. The security team notices that management events are being logged, but data events for Amazon S3 are not appearing in the CloudTrail logs for any account. The team needs to enable data event logging for S3 across all accounts. Currently, the organization trail is configured in the management account, and all member accounts have default CloudTrail configurations. What is the MOST efficient way to enable S3 data event logging for all current and future accounts in the organization?
⚠ Common exam trap
Candidates often think they need to create a new organization trail or involve member accounts, but the most efficient solution is to update the existing organization trail's event selectors, which automatically applies to all current and future accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the existing organization trail's event selectors in the management account to include S3 data events for all accounts.
An organization trail in the management account can have its event selectors updated to include S3 data events for all accounts in the organization. This change automatically applies to all existing and future member accounts, as organization trails are replicated to all accounts by AWS CloudTrail. No additional configuration is needed in member accounts, making it the most efficient approach.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ask each member account to create a new trail in their own account with S3 data events enabled.
Why it's wrong here
Member accounts lack the permissions to modify an organization trail, so they would need to create separate trails in each account to get S3 data events. This fragments log delivery across many S3 buckets, creates no single aggregation point, and does not automatically cover accounts that join the organization in the future, leaving compliance gaps and requiring repeated manual setup.
- ✓
Update the existing organization trail's event selectors in the management account to include S3 data events for all accounts.
Why this is correct
In the management account, edit the existing organization trail and update its event selectors to include S3 data events, choosing 'All S3 buckets' for object-level operations such as GetObject, PutObject, and DeleteObject. CloudTrail propagates this configuration to every member account, so all current and future accounts are captured automatically without per-account changes. This is the intended, least-effort method and keeps delivery centralized in the original destination bucket.
- ✗
Enable S3 server access logging on all S3 buckets across the organization and aggregate logs in a central S3 bucket.
Why it's wrong here
S3 server access logs are raw request logs written as objects to a separate S3 bucket, not CloudTrail events, and they cannot be queried through CloudTrail Lake, the event history console, or CloudTrail APIs. They also do not include the structured IAM principal context CloudTrail provides, and they have no integration with CloudTrail trails, so this approach would not satisfy the requirement to record API calls in CloudTrail.
- ✗
Create a new organization trail in the management account with S3 data events enabled, and share it with member accounts.
Why it's wrong here
A second organization trail would overlap with the existing trail, causing the same management and data events to be delivered twice and incurring duplicate CloudTrail charges. Also, CloudTrail does not have a 'share trail' feature—organization trails are automatically applied to member accounts, but the trail is still owned by the management account; you cannot distribute its configuration or grant member accounts control over it. The correct move is to modify the existing org trail, not create a redundant one.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.