SCS-C02 Management and Security Governance Practice Question

A security engineer discovers that an IAM user has a policy that allows them to delete any S3 bucket in the account. The engineer wants to audit all delete actions performed by this user. Which AWS service should be used?

⚠ Common exam trap

SCS-C02 often tests the difference between detection (GuardDuty), configuration compliance (Config), and audit logging (CloudTrail) — candidates pick GuardDuty because it is security-focused, but it does not provide the raw audit trail.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS CloudTrail

AWS CloudTrail records API activity in an AWS account, including S3 DeleteBucket and DeleteObject calls, capturing the identity of the caller, source IP, timestamp, and request parameters. To audit all delete actions performed by a specific IAM user, the engineer enables CloudTrail (ideally an organization trail or a trail with S3 log delivery) and filters events by the user's ARN and event names. CloudTrail is the authoritative audit log for AWS API actions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Amazon GuardDuty
Why it's wrong here
GuardDuty is a threat-detection service that analyses CloudTrail, VPC Flow Logs and DNS logs to surface findings such as anomalous or malicious activity; it does not provide the complete, queryable record of every delete action needed for an audit. It would be the right choice when hunting for compromised credentials or reconnaissance behaviour.
✗
AWS Config
Why it's wrong here
AWS Config records resource configuration changes and compliance, not API-level delete calls, so it cannot attribute S3 bucket deletions to the IAM user. It is tempting because Config tracks S3 bucket state and remediation, but auditing who performed delete actions requires CloudTrail management event logs.
✓
AWS CloudTrail
Why this is correct
AWS CloudTrail records every S3 API call, including DeleteBucket, capturing the IAM user's identity, timestamp, source IP and request parameters. This satisfies the audit requirement by providing an immutable event history of all delete actions performed by that user across the account.
✗
Amazon CloudWatch Logs
Why it's wrong here
CloudWatch Logs stores application and resource log streams, not a searchable record of API calls, so it cannot attribute S3 DeleteBucket events to a specific IAM user. It is tempting because CloudTrail can deliver its event history into CloudWatch Logs for metric filters and alarms, but that requires CloudTrail as the source.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Management and Security Governance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question