SCS-C02 Threat Detection and Incident Response Practice Question
A security engineer is investigating a potential compromise of an S3 bucket. The engineer needs to determine if any objects were accessed by an unauthorized user. Which AWS service can provide detailed access logs for S3 objects?
⚠ Common exam trap
Many exam-takers assume AWS CloudTrail is sufficient for all logging needs, but the exam specifically tests the distinction between management events (CloudTrail default) and data-level object access logs (S3 server access logs), and that CloudTrail data events require explicit enablement and still lack the granularity of server access logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
S3 server access logs
S3 server access logs provide detailed records of requests made to an S3 bucket, including the requester, bucket name, request time, action, and response status. This granularity is essential for identifying unauthorized access to specific objects, as it logs every GET, PUT, DELETE, and HEAD request at the object level. AWS CloudTrail, while useful for management events, does not log data-level operations like object reads by default unless data events are explicitly enabled, and even then, it may not capture all object-level access details as comprehensively as server access logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail records API activity, but S3 object-level data events (e.g., GetObject, PutObject) are not captured by default and must be explicitly enabled on each bucket. Even when enabled, CloudTrail data events are often used for governance and audit trail analysis, not as a substitute for per-request access logs. For a compromise investigation, CloudTrail may show the principal and API calls, but missing object-level read/write history unless data events were already configured, making it an incomplete source in this scenario.
- ✓
S3 server access logs
Why this is correct
S3 server access logs provide a comprehensive, per-request record of every call made to a bucket, including requester identity, bucket name, object key, request type, HTTP status, error codes, source IP address, User-Agent, and timestamps. This granular data is exactly what is needed to trace unauthorized access or data exfiltration during a compromise. Unlike CloudTrail, server access logs are enabled directly on the S3 bucket and capture all requests, even those that are denied or made anonymously, making them the most direct evidence source.
- ✗
AWS Config
Why it's wrong here
AWS Config records resource configuration changes and evaluates them against compliance rules, such as changes to S3 bucket policies or lifecycle rules. It does not log individual object access requests or track who read a specific object. While Config can indicate that a bucket policy was altered during a compromise, it cannot show whether an object was actually accessed or by whom, so it is not a source of object-level access evidence.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management service that scans compute resources like EC2 instances and container images for software vulnerabilities and unintended network exposure. It does not capture, store, or analyze S3 object access logs, nor does it provide any historical record of data access events. Therefore, it is irrelevant to this investigation because the engineer needs access logs, not vulnerability findings.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.