SCS-C02 Security Logging and Monitoring Practice Question
A security engineer is troubleshooting why CloudTrail is not delivering logs to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured with the correct bucket name. However, no log files appear. What is the most likely cause?
⚠ Common exam trap
The trap here is that candidates often focus only on the S3 bucket policy and overlook the separate KMS key policy requirement, assuming that SSE-KMS encryption is transparent to CloudTrail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The S3 bucket uses AWS KMS server-side encryption (SSE-KMS) and the KMS key policy does not grant CloudTrail permission to use the key.
When CloudTrail is configured to deliver logs to an S3 bucket that uses SSE-KMS, CloudTrail must have explicit permission to use the KMS key for encrypting the log files. Even if the bucket policy allows CloudTrail to write objects, the KMS key policy must grant the `kms:GenerateDataKey` and `kms:Decrypt` actions to the CloudTrail service principal. Without these permissions, CloudTrail cannot encrypt the logs, and delivery fails silently—no log files appear.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The S3 bucket has an S3 Object Lock configuration that prevents writes.
Why it's wrong here
S3 Object Lock does not block initial PutObject requests; it only restricts deletion or overwriting of existing versions according to a retention mode and period. CloudTrail writes new log objects on a regular basis, and unless the bucket policy denies s3:PutObject, Object Lock will not prevent those deliveries. Even with a default retention policy, writes succeed and the logs are merely locked against modification.
- ✗
The S3 bucket is in a different AWS Region from the trail.
Why it's wrong here
CloudTrail can deliver log files to an S3 bucket in any AWS Region, not only the bucket's or trail's home region. The trail must have a bucket policy that permits the CloudTrail service principal to write objects, and the bucket may be in a different account or region. A regional mismatch alone is not a cause of delivery failure, so this does not explain the troubleshooting issue.
- ✗
CloudTrail is not enabled in the AWS Region where the S3 bucket resides.
Why it's wrong here
CloudTrail is a regional service, but a trail is created in a home region and can record and deliver events for all regions when configured as a multi-region trail. The S3 bucket resides in some region, but CloudTrail does not need to be enabled specifically in the bucket's region to deliver logs to it. What matters is that the trail is active and the bucket policy allows CloudTrail to write; the bucket region is irrelevant.
- ✓
The S3 bucket uses AWS KMS server-side encryption (SSE-KMS) and the KMS key policy does not grant CloudTrail permission to use the key.
Why this is correct
When a destination bucket uses SSE-KMS, CloudTrail must have permission to call kms:GenerateDataKey for encrypting each log file and kms:Decrypt for delivering or reading those files. If the KMS key policy does not explicitly grant CloudTrail these actions, PutObject requests to the bucket will fail even if the bucket policy is correct. CloudTrail’s role also needs the appropriate KMS permissions in the trail’s advanced settings, but the key policy is the critical constraint here.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.