SCS-C02 Threat Detection and Incident Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Amazon S3 server access logs

  Why it's wrong here

  S3 server access logs capture object-level requests (e.g., GET, PUT) along with requester, bucket, key, and response status, but they are delivered to a target bucket on a best-effort basis with delays that can stretch to hours. This makes them inappropriate for investigating a potential exfiltration in near real time, because the attacker's activity may not appear until long after the incident, and the logs often require additional parsing or ETL to correlate with other security signals.

• ✗

  AWS IAM Access Analyzer

  Why it's wrong here

  AWS IAM Access Analyzer is a policy-analysis tool that inspects resource policies (such as S3 bucket policies or KMS key policies) to identify resources shared with external principals, but it does not record or inspect data-plane activity. It can only reveal that a bucket is potentially accessible from outside, not whether an object was actually read or copied. Therefore, it cannot provide evidence that exfiltration occurred; it merely flags exposure that could be exploited, which is a fundamentally different type of signal than operation logs.

• ✓

  AWS CloudTrail data events for S3

  Why this is correct

  CloudTrail data events for S3 capture object-level API calls such as GetObject, PutObject, and ListBucket, recording the IAM principal, source IP address, timestamp, and specific request parameters. Unlike management events, data events require explicit enablement on the trail or bucket, but once enabled they provide queryable, near real-time records of exactly the operations an attacker would perform to extract data. This gives investigators the necessary combination of user identity, network origin, and object-level action to confirm or refute exfiltration, making it the correct choice.

• ✗

  Amazon VPC Flow Logs

  Why it's wrong here

  VPC Flow Logs record network metadata at the elastic network interface level, including source and destination IP addresses, ports, protocol, and byte counts. When S3 is accessed via a gateway endpoint, interface endpoint, or public internet, flow logs will show connections to S3's IP ranges and data transfer sizes, but they cannot identify which API operation was invoked or which object was requested. An investigator might see a large volume of outbound bytes, but without object-level detail they cannot attribute it to a specific user or confirm that a download occurred, so these logs alone are insufficient to prove data exfiltration.

Go deeper

Related to this question