SCS-C02 Threat Detection and Incident Response Practice Question

A company uses AWS CloudTrail to log all API calls. During an incident investigation, the security team needs to identify who deleted an S3 bucket. CloudTrail logs are stored in a centralized S3 bucket with server-side encryption using AWS KMS. Which additional step is required to ensure the CloudTrail logs can be queried quickly for this investigation?

⚠ Common exam trap

A common mix-up: candidates assume CloudTrail logs must be streamed to CloudWatch Logs for querying, but Athena provides a more direct and cost-effective solution for querying historical logs stored in S3 without additional streaming overhead.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use Amazon Athena with a table defined over the S3 bucket

Amazon Athena allows you to query CloudTrail logs directly in S3 using standard SQL without needing to move or transform the data. Since the logs are already in a centralized S3 bucket, defining a table over that location enables fast, ad-hoc queries to identify the specific DeleteBucket event, including who performed it and when. This approach is cost-effective and avoids additional streaming or storage costs.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Enable CloudTrail Lake
Why it's wrong here
CloudTrail Lake is a managed event data store that lets you run SQL queries with CloudTrail Lake queries, but it only searches events ingested into its own data stores, not the existing gzipped JSON objects already in the S3 bucket. You would have to create a separate event data store and import the historical S3 logs, which is redundant because Amazon Athena can query those same S3 objects directly with standard SQL. Enabling Lake thus adds cost and setup without being a necessary step for analyzing the logged API calls.
✗
Stream logs to CloudWatch Logs and use CloudWatch Logs Insights
Why it's wrong here
CloudTrail can be configured to deliver events to CloudWatch Logs, where CloudWatch Logs Insights can perform queries, but that is a separate forward-going delivery path and does not grant visibility into the CloudTrail log files already accumulated in the S3 bucket. The S3 objects remain as compressed JSON files that CloudWatch Logs Insights cannot access; it queries log groups, not object storage. Backfilling historical S3 logs into CloudWatch Logs would require a custom import job, so this option is not the direct solution for querying the existing logs.
✓
Use Amazon Athena with a table defined over the S3 bucket
Why this is correct
Amazon Athena can query CloudTrail logs stored in S3 by defining a table over the bucket using the CloudTrail SerDe, with columns matching the JSON event structure and partitions for date/hour. The table is either created manually via a DDL statement or automatically by the 'Create Athena table' option in the CloudTrail console. Athena then runs standard SQL directly on the compressed log objects without moving or transforming the data, making it the simplest serverless way to search all API calls.
✗
Enable Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a continuous security monitoring service that consumes CloudTrail events, VPC Flow Logs, and DNS logs to generate threat findings using machine learning and threat intelligence. It does not expose a query interface over the full API activity history; it only produces alerts for suspicious patterns, such as unusual API calls or credential abuse. To review every API call as part of an investigation, you need to run arbitrary SQL queries against the raw CloudTrail data, which GuardDuty is not designed to do.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Threat Detection and Incident Response Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question