SCS-C02 Data Protection Practice Question
A company uses AWS KMS to encrypt data in Amazon S3. The security team needs to audit all KMS key usage, including who used the key, when, and what operation was performed. Which AWS service should be used to meet this requirement?
⚠ Common exam trap
A common mix-up: candidates confuse AWS Config's compliance monitoring with CloudTrail's API auditing, or assume GuardDuty's threat detection includes detailed usage logs, when in fact only CloudTrail provides the granular, user-specific API call records required for auditing KMS key usage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail is the correct service because it records all AWS KMS API calls as events, including who made the request, the source IP address, the time of the request, and the specific operation performed (e.g., Encrypt, Decrypt, GenerateDataKey). These audit logs are stored in an S3 bucket and can be analyzed to meet the security team's requirement for full key usage auditing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is correct because it records KMS API calls, including management-plane operations like CreateKey, ScheduleKeyDeletion, and PutKeyPolicy, and data-plane operations such as Encrypt, Decrypt, and GenerateDataKey when data events are enabled. When an S3 object encrypted with SSE-KMS is accessed, CloudTrail generates an event for the corresponding KMS Decrypt call, providing a complete audit trail of who used which key, when, and from what context. These logs can be delivered to an S3 bucket and optionally sent to CloudWatch Logs for alerting and forensic analysis, making CloudTrail the definitive service for KMS-related audit and compliance.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS query logs, and CloudTrail management events to identify malicious or anomalous behavior, such as brute-force attempts or data exfiltration from a compromised instance. It does not, however, act as a comprehensive audit logger for KMS; it consumes existing CloudTrail logs as a source but does not provide the granular, per-API-call history needed to answer 'who decrypted this S3 object and when.' While GuardDuty can help detect threats that may involve KMS misuse, it never substitutes for the raw CloudTrail data itself, so it does not satisfy a KMS logging/auditing requirement.
- ✗
AWS Config
Why it's wrong here
AWS Config is a resource configuration tracking service that records configuration snapshots and changes for supported AWS resources, such as KMS keys and S3 buckets, and evaluates them against compliance rules (e.g., whether a KMS key has rotation enabled or whether a key policy permits cross-account access). It does not log API operations like Decrypt or GenerateDataKey, because those are transient data-plane actions that do not alter resource configuration. Config can show you the state and history of a KMS key over time, but it cannot tell you who called which KMS API or when, making it the wrong service for auditing KMS API activity.
- ✗
AWS CloudHSM
Why it's wrong here
AWS CloudHSM is a hardware security module (HSM) service that provides customers with dedicated, FIPS 140-2 Level 3 validated HSMs for performing cryptographic operations like key generation, signing, and encryption, often for regulatory or key-ownership requirements. It is a separate cryptographic infrastructure offering, not an audit or logging service; CloudHSM instances do not log KMS API calls, nor do they appear in CloudTrail for KMS events. In fact, CloudHSM is an alternative to AWS KMS for customers who need to manage their own HSM keys without the key material leaving the device, so it does not provide the logging capability described in the question.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.