SCS-C02 Security Logging and Monitoring Practice Question
A company wants to ensure that all S3 buckets are encrypted at rest. Which THREE services can be used to detect and alert on unencrypted buckets?
⚠ Common exam trap
Many exam-takers think Amazon CloudWatch Logs Insights or VPC Flow Logs can be used for configuration auditing, but they are designed for log analysis and network monitoring, not for detecting resource configuration states like encryption settings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
AWS Config can evaluate S3 bucket configurations against managed rules like 's3-bucket-server-side-encryption-enabled' to detect unencrypted buckets. When a bucket violates the rule, AWS Config can trigger an Amazon SNS notification or invoke a Lambda function for remediation, enabling real-time alerting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Config
Why this is correct
AWS Config provides a managed rule, s3-bucket-server-side-encryption-enabled, that continuously evaluates each S3 bucket's configuration to determine whether default encryption is set to SSE-S3, SSE-KMS, or DSSE. It records the compliance state as a resource configuration history and can trigger automatic remediation actions, such as enabling encryption via a Systems Manager automation document. This gives you ongoing, real-time visibility into unencrypted buckets rather than relying on post-hoc event detection.
- ✗
Amazon CloudWatch Logs Insights
Why it's wrong here
CloudWatch Logs Insights is a query engine designed to run interactive SQL-like queries across log data stored in CloudWatch Logs, such as application or CloudTrail logs. It cannot directly inspect the configuration state of an S3 bucket or enforce encryption policies, because it has no access to resource configuration APIs or configuration items. Even if you query CloudTrail logs for encryption-related API calls, you are only analyzing historical activity, not verifying the actual current state of bucket encryption.
- ✗
Amazon VPC Flow Logs
Why it's wrong here
VPC Flow Logs capture metadata about IP traffic flowing through network interfaces in a VPC, including source and destination addresses, ports, protocol, and packet counts. They contain no data about S3 bucket configuration, such as encryption settings, access policies, or lifecycle rules. Therefore, VPC Flow Logs are entirely unrelated to detecting or enforcing S3 bucket encryption and provide no compliance information.
- ✓
AWS Security Hub
Why this is correct
AWS Security Hub acts as a central aggregator that collects security findings from multiple sources, including AWS Config rules, and presents them under standards such as CIS AWS Foundations. You can enable the Config managed rule for S3 server-side encryption and Security Hub will surface any noncompliant bucket as a finding, allowing you to monitor via the dashboard or integrate with ticketing systems. However, Security Hub relies on AWS Config to evaluate the underlying encryption status and does not perform the direct configuration checks itself.
- ✓
AWS CloudTrail with Amazon CloudWatch Events
Why this is correct
CloudTrail logs S3 management events, including CreateBucket and PutBucketEncryption, which you can route to a CloudWatch Events rule to trigger a Lambda function or SNS notification. This approach is event-driven and reactive: it only catches misconfiguration when an API call is made, so it can alert on a bucket being created without encryption or when encryption is disabled, but it does not proactively audit existing buckets or provide continuous compliance. It is a valid detection mechanism, but unlike AWS Config, it does not maintain a current compliance state of every bucket.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.