Immutable AWS CloudTrail Logs Using S3 Object Lock
A company wants to ensure that all API calls in their AWS account are logged and immutable. Which TWO actions should be taken? (Choose TWO.)
Quick Answer
Meeting a requirement that all API calls be both logged and immutable breaks into two separate sub-requirements, and the correct pair of actions maps one action to each half rather than one action trying to do both jobs. Enabling AWS CloudTrail across all regions satisfies the logging half, since a trail scoped to only one region would miss API activity happening anywhere else, and all API calls has to mean the full account footprint, not just a single region's activity. Enabling S3 Object Lock on the bucket that receives the CloudTrail logs satisfies the immutability half, since Object Lock enforces a write-once-read-many model at the storage layer, meaning delivered log files cannot be overwritten or deleted by any principal, including the account's root user, for as long as the lock's retention settings apply. Neither action alone meets the full requirement: all-regions CloudTrail without Object Lock produces a complete log that could still be tampered with or deleted, while Object Lock on a bucket receiving only a single region's trail produces an immutable but incomplete record. Whenever a question bundles two distinct properties into one requirement, such as completeness of logging and tamper-resistance of storage, expect the answer to be a pair of actions where each is responsible for exactly one property rather than a single feature claiming to cover both.
⚠ Common exam trap
Many exam-takers confuse encryption (Option D) with immutability, or they think MFA delete (Option A) provides sufficient protection, but neither prevents overwrites or ensures a WORM state, which is the core requirement for immutable logging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable S3 Object Lock on the CloudTrail S3 bucket
Enabling S3 Object Lock on the CloudTrail S3 bucket ensures that log files are immutable and cannot be overwritten or deleted by any user, including root. This is achieved through a write-once-read-many (WORM) model, which is essential for maintaining a tamper-proof audit trail of all API calls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable MFA delete on the S3 bucket
Why it's wrong here
MFA delete requires additional authentication but does not guarantee immutability.
- ✗
Use AWS Config rules to monitor CloudTrail configuration
Why it's wrong here
Config monitors configuration but does not ensure immutability.
- ✓
Enable S3 Object Lock on the CloudTrail S3 bucket
Why this is correct
Object Lock prevents log deletion or modification.
- ✗
Encrypt the S3 bucket with AWS KMS
Why it's wrong here
Encryption protects data at rest but does not prevent deletion.
- ✓
Enable AWS CloudTrail for all regions
Why this is correct
CloudTrail records API calls.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to ensure that all API calls made to their AWS account are logged and immutable. They have enabled AWS CloudTrail and are delivering logs to an S3 bucket. The security team requires that logs cannot be deleted or modified by anyone, including the root user. What should they do?
easy- ✓ A.Enable S3 Object Lock with Compliance retention mode on the bucket.
- B.Enable MFA Delete on the S3 bucket.
- C.Enable S3 Versioning on the bucket.
- D.Add a bucket policy that denies s3:DeleteObject for all principals.
Why A: S3 Object Lock with retention mode Compliance prevents any user, including root, from deleting or overwriting objects. Option B is wrong because MFA Delete prevents deletion but requires additional authentication and can be disabled by root if they have MFA. Option C is wrong because versioning alone does not prevent deletion of versions; objects can still be deleted, though old versions are retained. Option D is wrong because bucket policies can be changed by root, so a deny policy is not immutable.
Variation 2. A security engineer needs to ensure that all changes to IAM policies in an AWS account are logged and that the logs are immutable and cannot be deleted by any user, including the root user. Which actions should the engineer take? (Choose two.)
easy- A.Enable default encryption with AWS KMS on the bucket.
- ✓ B.Enable AWS CloudTrail to log IAM events.
- C.Enable S3 Versioning on the bucket.
- D.Enable multi-factor authentication (MFA) delete on the S3 bucket.
- ✓ E.Enable S3 Object Lock in compliance mode on the bucket.
Why B: AWS CloudTrail is the service specifically designed to log all API activity, including IAM policy changes. By enabling CloudTrail with management event logging, all IAM CreatePolicy, PutPolicy, DeletePolicy, and similar actions are recorded in a log file delivered to an S3 bucket. This provides an authoritative audit trail of who made the change, when, and from which source IP. Option E is correct because S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This ensures the log files are immutable and cannot be tampered with or deleted, fulfilling the requirement that logs cannot be deleted by any user.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.