SCS-C02 Security Logging and Monitoring Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The user used the AWS Management Console, not the CLI

  Why it's wrong here

  CloudTrail logs management events regardless of the client used to issue the API call; the AWS Management Console, CLI, SDKs, and other tools all generate the same underlying API requests that CloudTrail captures. Therefore, using the console rather than the CLI would still produce CloudTrail events, and the request source cannot change the 90-day retention limit of event history. The user's inability to find old events is a retention issue, not an ingestion or access-method issue.

• ✗

  The trail is configured for a single region only

  Why it's wrong here

  A trail configured for a single region only records management events for that region, but CloudTrail's 'Event history' page is a separate account-level feature that displays events for all regions unless filtered. Even with a single-region trail, you can still view up to 90 days of event history, because the 90-day retention is fixed and independent of the trail's region scope. Thus, the regional configuration would affect what events are delivered to an S3 bucket, but it does not explain the absence of events older than 90 days.

• ✗

  The API calls were read-only and excluded by default

  Why it's wrong here

  CloudTrail management event logging includes both read and write operations by default; the optional 'read-only' filter is used to classify events after capture, not to exclude read-only calls from logging. The CloudTrail event history page records read-only management events such as Describe* and List* calls as part of its default configuration, so these API calls are present in event history. Therefore, read-only calls cannot be the reason that events older than 90 days are missing.

• ✓

  CloudTrail event history only retains events for 90 days; older events are not visible

  Why this is correct

  CloudTrail event history is a built-in feature that provides a view of the last 90 days of account activity, and this retention period is not configurable. Once an event is older than 90 days, it is no longer visible in event history, and the only way to retain it is to configure a trail that delivers CloudTrail log files to Amazon S3 (and optionally CloudWatch Logs) with a suitable lifecycle policy. This 90-day limit applies uniformly to all management events, regardless of the client, region scope, or whether the calls are read-only or write-only.

Go deeper

Related to this question