SCS-C02 Security Logging and Monitoring Practice Question
A company wants to centralize security logs from multiple AWS accounts into a single S3 bucket. The logging accounts (e.g., security, production) each have their own CloudTrail trails. Which configuration is required to allow cross-account log delivery?
⚠ Common exam trap
Test-takers frequently assume cross-account access requires an IAM role (Option A) or shared encryption keys (Option B), but AWS services like CloudTrail use service principals and bucket policies for cross-account log delivery, not IAM roles or ACLs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an S3 bucket policy in the destination account that allows the CloudTrail service principal to write objects.
CloudTrail cross-account log delivery requires the destination S3 bucket to have a bucket policy that explicitly grants the CloudTrail service principal (`cloudtrail.amazonaws.com`) permission to write objects (e.g., `s3:PutObject`). This allows CloudTrail in any source account to deliver logs directly to the bucket without needing IAM roles or shared credentials, as the service principal authenticates on behalf of the source account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an IAM role in the destination account with write permissions and allow CloudTrail in source accounts to assume that role.
Why it's wrong here
CloudTrail does not assume IAM roles in the destination account to deliver logs; it uses the CloudTrail service principal (cloudtrail.amazonaws.com) and relies on a resource-based S3 bucket policy to authorize writes. An IAM role also fails because it would require CloudTrail to authenticate as the role, which the service does not support, and cross-account delivery requires a bucket-level grant that explicitly names the service principal and source account.
- ✗
Use a customer-managed KMS key in the destination account and share it with the source accounts.
Why it's wrong here
Sharing a customer-managed KMS key is only a supporting condition for cross-account CloudTrail logging; it cannot authorize the actual S3 write because CloudTrail checks the destination bucket policy for permission. Without a bucket policy that permits s3:PutObject to the CloudTrail service principal, the KMS key grant alone does not enable logs to cross the account boundary, and any KMS operation would also fail if the bucket policy isn't present.
- ✓
Create an S3 bucket policy in the destination account that allows the CloudTrail service principal to write objects.
Why this is correct
A bucket policy in the destination account is the only mechanism CloudTrail uses to authorize cross-account log delivery, so the policy must allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform s3:PutObject and s3:GetBucketAcl on the bucket. For additional security, restrict the policy with aws:SourceAccount or aws:SourceArn to a specific source account, and when SSE-KMS is enabled, also include kms:GenerateDataKey and kms:Decrypt in the policy.
- ✗
Configure S3 bucket ACLs to grant write access to the source account IDs.
Why it's wrong here
S3 ACLs are not honored for CloudTrail cross-account delivery because CloudTrail evaluates only the bucket policy, not ACLs, when deciding whether the service principal can write logs. ACLs also lack the service-principal targeting and source-account conditions needed to safely scope permissions, and AWS discourages ACLs for this use case because bucket policies provide finer-grained, auditable controls.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.