SCS-C02 Security Logging and Monitoring Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Stream logs to CloudWatch Logs for real-time monitoring.

  Why it's wrong here

  Streaming CloudTrail events to CloudWatch Logs is excellent for real-time alerting, but it does not create a tamper-proof audit record. CloudWatch Logs lacks S3 Object Lock or equivalent WORM protection, and any IAM principal with logs:DeleteLogGroup or log retention permission can modify or purge history. This option addresses operational observability, not the immutable integrity that an audit logging strategy requires.

• ✓

  Create an AWS CloudTrail organization trail that logs to a central S3 bucket.

  Why this is correct

  An organization trail in the management account is the only single configuration that captures management events from every account within the AWS Organization, including member accounts, and delivers them to a designated central S3 bucket. This avoids needing to deploy separate trails per account, centralizes the audit source of record, and is the appropriate backbone for the logging strategy described in the scenario.

• ✓

  Enable S3 Object Lock in Compliance mode on the central bucket.

  Why this is correct

  Enabling S3 Object Lock in Compliance mode on the central S3 bucket makes every delivered log object WORM, so no principal—not even the AWS account root user—can delete or overwrite the objects before the retention period expires. Compliance mode is critical for a true immutable audit trail because Governance mode can be lifted by a user with s3:BypassGovernanceRetention, while Compliance mode cannot. This directly guarantees that CloudTrail logs remain unaltered for forensic and regulatory review.

• ✗

  Enable VPC Flow Logs in all accounts and send to the central bucket.

  Why it's wrong here

  VPC Flow Logs record network-level metadata such as source/destination IPs, ports, protocol, and packets, so they cannot reconstruct who performed an API action or what resource was changed. Even if shipped to a central bucket, they are unrelated to CloudTrail management event logs and are not a valid mechanism for tracking account activity in this architecture. Flow logs are complementary for network troubleshooting but do not satisfy the requirement for an immutable record of administrative actions.

• ✓

  Grant the central bucket policy to allow only the CloudTrail service to write logs.

  Why this is correct

  Scoping the bucket policy with a service principal condition for cloudtrail.amazonaws.com and aws:SourceArn/aws:SourceAccount prevents IAM users, roles, or other AWS services from writing to the bucket, eliminating a common path for log tampering or accidental corruption. This write-only restriction is a defense-in-depth control that must accompany Object Lock because CloudTrail is the only writer that should ever place files into the central audit bucket. It also helps ensure the bucket name and account context in each policy statement match CloudTrail's delivery requirements.

Go deeper

Related to this question