CloudTrail Log Encryption and Long-Term Retention
A security engineer needs to ensure that all API calls in an AWS account are logged and that the logs are encrypted at rest and retained for at least 7 years. Which THREE steps should the engineer take? (Choose THREE.)
Quick Answer
The correct answer involves enabling CloudTrail, applying S3 default encryption, and configuring a lifecycle policy to transition logs to Glacier. CloudTrail captures all API calls across your AWS account, while S3 default encryption ensures the logs are encrypted at rest using server-side encryption, and a lifecycle policy moves older logs to Glacier for cost-effective long-term retention of at least seven years. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of CloudTrail’s integration with S3 storage classes and encryption features, often appearing as a multi-select question where common traps include assuming CloudTrail can write directly to Glacier or confusing replication with retention. Remember the mnemonic “CLG” for CloudTrail, encryption, and Glacier lifecycle to quickly recall the three required steps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set an S3 lifecycle policy to transition logs to Glacier after 7 years.
To ensure all API calls are logged, encrypted at rest, and retained for at least 7 years, the correct steps are: E. Enable CloudTrail in the account to capture API calls; D. Enable S3 default encryption on the log bucket to encrypt logs at rest; and B. Set an S3 lifecycle policy to transition logs to Glacier after 7 years for long-term retention. Option A is incorrect because CloudTrail cannot deliver logs directly to Glacier; it delivers to an S3 bucket first. Option C is incorrect because Cross-Region Replication helps with geographic redundancy but does not address retention or encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure CloudTrail to deliver logs to Amazon S3 Glacier.
Why it's wrong here
CloudTrail delivers to S3, not directly to Glacier.
- ✓
Set an S3 lifecycle policy to transition logs to Glacier after 7 years.
Why this is correct
Retains logs for 7 years.
- ✗
Enable S3 Cross-Region Replication to a bucket in another region.
Why it's wrong here
For disaster recovery, not retention.
- ✓
Enable S3 default encryption on the log bucket.
Why this is correct
Encrypts logs at rest.
- ✓
Enable CloudTrail in the account.
Why this is correct
Logs all API calls.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security team needs to ensure that all API calls made in the AWS account are logged and the logs are stored in a central S3 bucket that is encrypted with a KMS key. Which combination of steps should the team take to achieve this?
medium- A.Enable AWS Config and have it deliver configuration history to an encrypted S3 bucket.
- B.Enable CloudWatch Logs and stream logs to an encrypted S3 bucket.
- C.Enable VPC Flow Logs and publish to an encrypted S3 bucket.
- ✓ D.Enable CloudTrail and configure it to deliver logs to an encrypted S3 bucket.
Why D: CloudTrail logs all API calls and can deliver them to an encrypted S3 bucket. Option A is incorrect because AWS Config records resource configuration changes, not API calls. Option B is incorrect because CloudWatch Logs logs application and system events but does not natively store logs directly in S3; it would require additional configuration. Option C is incorrect because VPC Flow Logs capture network traffic metadata, not API calls.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.