Most Cost-Effective CloudTrail Log Retention for 7 Years
An organization has a requirement to retain all AWS CloudTrail logs for at least 7 years for compliance. Currently, logs are stored in an S3 bucket with default settings. What is the MOST cost-effective way to meet the retention requirement?
Quick Answer
Meeting a long compliance retention requirement cost-effectively is a storage-tiering problem, not just a retention-duration problem, which is why the correct answer pairs a transition with an expiration rather than using either alone. An S3 lifecycle policy that moves CloudTrail log objects into S3 Glacier after 30 days takes advantage of the fact that log files are usually accessed only in the days right after they're written, so shifting them into cheaper archival storage once that active window passes sharply cuts storage cost for the years the logs sit there satisfying a compliance requirement. The same lifecycle policy then expires, meaning deletes, the objects at the 7-year mark, actually enforcing the retention period rather than leaving logs to accumulate indefinitely at real cost. This is why the weaker options fall short: storing everything in Glacier Deep Archive from day one ignores that logs may need occasional access shortly after creation and doesn't handle expiration either, deleting after 7 years without a transition step keeps logs in expensive storage the whole time for no benefit, and CloudTrail itself has no built-in retention setting, since that is handled through S3 lifecycle rules. Whenever a question asks for the most cost-effective way to retain logs over a long compliance window, expect the answer to combine a storage-class transition for older data with an expiration set to the exact retention period required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure S3 lifecycle policy to transition objects to S3 Glacier after 30 days and expire after 7 years.
The most cost-effective because it uses an S3 lifecycle policy to transition objects to S3 Glacier after 30 days (reducing storage costs for older logs) and then expires (deletes) them after 7 years to meet the retention requirement. Option A is wrong because storing logs directly in S3 Glacier Deep Archive is not cost-effective for logs that may be accessed occasionally and does not automatically expire after 7 years without additional policy. Option B is wrong because simply deleting after 7 years does not take advantage of cheaper storage tiers. Option C is wrong because CloudTrail trails do not have a retention setting; retention must be managed via S3 lifecycle policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use S3 Glacier Deep Archive immediately.
Why it's wrong here
Deep Archive is cheaper but retrieval costs are high if needed.
- ✗
Set an S3 lifecycle policy to delete objects after 7 years.
Why it's wrong here
Deleting after 7 years meets the requirement but does not provide cost savings during retention.
- ✗
Set the CloudTrail trail to store logs in an S3 bucket with 7-year retention.
Why it's wrong here
CloudTrail does not have retention settings.
- ✓
Configure S3 lifecycle policy to transition objects to S3 Glacier after 30 days and expire after 7 years.
Why this is correct
Transitioning to Glacier reduces cost while meeting retention.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is implementing a data retention policy for CloudTrail logs. The logs are stored in an S3 bucket. The policy requires that logs be retained for 7 years and then automatically deleted. Which TWO actions should the security engineer take to meet this requirement?
medium- A.Use AWS Backup to manage retention and deletion.
- ✓ B.Enable S3 Object Lock in compliance mode on the bucket.
- C.Configure the S3 bucket policy to deny s3:DeleteObject actions for all principals.
- D.Enable S3 Versioning and create a lifecycle policy to delete noncurrent versions.
- ✓ E.Create an S3 Lifecycle policy that expires objects after 2555 days (7 years).
Why B: To retain logs for 7 years and then automatically delete, the security engineer should enable S3 Object Lock in compliance mode (B) to prevent any deletion during the retention period, and create an S3 Lifecycle policy to expire objects after 2555 days (E). The Object Lock ensures logs cannot be deleted prematurely, while the lifecycle policy handles automatic deletion after 7 years. Option C is incorrect because denying s3:DeleteObject to all principals would block the lifecycle policy from deleting objects. Options A and D are not suitable for this requirement.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.