SCS-C02 Security Logging and Monitoring Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create an Amazon EventBridge rule that matches CloudTrail CreateBucket API calls and triggers a Lambda function that inspects the bucket's public access settings and alerts if public.

  Why this is correct

  An EventBridge rule can pattern-match CloudTrail API events as they are emitted, meaning a CreateBucket call with a public access configuration triggers the Lambda function within seconds of the API completing. The Lambda can then use GetPublicAccessBlock, GetBucketPolicyStatus, or GetBucketAcl to determine whether the bucket is actually public and immediately alert a security team, making this the only option that combines near-real-time detection with direct inspection of the resulting bucket configuration.

• ✗

  Use AWS Config rules to check S3 bucket public access settings and trigger an AWS Lambda function to send alerts.

  Why it's wrong here

  AWS Config rules evaluate resources on a continuous basis, but the evaluation cadence is either periodic (default 24 hours) or triggered by configuration changes recorded by AWS Config, which can take several minutes to be processed. Even with a change-triggered rule, there is no guarantee that the alert fires within minutes of the original CreateBucket API call, and AWS Config does not directly act on CloudTrail events, so this approach introduces unacceptable latency for a real-time security alerting requirement.

• ✗

  Use S3 server access logs and run a daily script to parse the logs for PutBucketAcl actions.

  Why it's wrong here

  S3 server access logs are best-effort and often delivered with significant delay (sometimes hours), and they record low-level request details on the bucket itself rather than AWS API activity in CloudTrail. Running a daily script to parse these logs for PutBucketAcl actions means that a newly public bucket could remain exposed for up to a day before detection, and the log delivery itself may be incomplete or delayed, making this option both slow and unreliable for immediate alerting.

• ✗

  Enable CloudTrail log file validation and use Athena to query logs hourly for CreateBucket events with public ACLs.

  Why it's wrong here

  CloudTrail log file validation is a cryptographic integrity mechanism that verifies log files were not modified; it has nothing to do with detecting events or triggering workflow. While Athena can query CloudTrail logs stored in S3, CloudTrail logs are typically delivered every 5 minutes or longer, and running a query hourly means a bucket could be publicly accessible for up to 60 minutes before an alert is generated, which fails the near-real-time requirement of the scenario.

Go deeper

Related to this question