SCS-C02 Threat Detection and Incident Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable data events in the CloudTrail trail.

  Why this is correct

  CloudTrail data events record S3 object-level operations such as GetObject, PutObject, and DeleteObject. Enabling data events is essential because management events only cover control-plane actions (e.g., bucket creation or policy changes), not the actual access to objects. Data events must be explicitly enabled in the trail, as they are not on by default due to their high volume, but they are exactly what you need to monitor object-level activity.

• ✗

  Enable S3 server access logs on the bucket.

  Why it's wrong here

  S3 server access logs are generated by S3 itself, providing detailed records of requests made to a bucket, but they are a completely separate mechanism from CloudTrail. They are delivered to a destination bucket in a specific log format and are not integrated into CloudTrail trail configuration or event history. For monitoring via CloudTrail, you must enable data events; S3 server access logs are an alternative logging path, not a substitute or prerequisite.

• ✗

  Enable management events in the CloudTrail trail.

  Why it's wrong here

  Management events in CloudTrail record control-plane operations on S3, such as creating a bucket, configuring lifecycle rules, or changing bucket policies. While management events are enabled by default in a trail, they do not capture object-level operations like reads or writes to individual objects. To monitor object access, you specifically need data events, so relying on management events alone will leave a critical gap in visibility.

• ✗

  Enable S3 Object Lambda.

  Why it's wrong here

  S3 Object Lambda is a feature that lets you invoke custom Lambda functions on data retrieved from S3 before it is returned to the caller, enabling on-the-fly transformation or redaction. It has no role in logging or monitoring object activity; it processes requests in the data path but does not record or emit access logs. Enabling Object Lambda would add processing overhead without providing any audit trail for object-level operations.

• ✓

  Specify the S3 bucket ARN or prefix in the trail configuration.

  Why this is correct

  In a CloudTrail trail, enabling data events for S3 requires you to explicitly specify the resources to monitor, either by bucket ARN or by a prefix for a subset of objects. Without this specification, CloudTrail cannot know which buckets to capture object-level events for, leaving the trail unable to record the desired activity. This configuration step is a required complement to enabling data events, ensuring the trail logs the exact S3 resources you intend to monitor.

Go deeper

Related to this question