SCS-C02 Security Logging and Monitoring Practice Question

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudtrail.amazonaws.com"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-trail-bucket/AWSLogs/123456789012/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-acl": "bucket-owner-full-control"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudtrail.amazonaws.com"
      },
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws:s3:::my-trail-bucket"
    }
  ]
}

Refer to the exhibit. A security engineer configured this S3 bucket policy for CloudTrail, but CloudTrail logs are not being delivered. What is the MOST likely missing permission?

⚠ Common exam trap

SCS-C02 often tests the misconception that s3:GetBucketAcl alone is sufficient for CloudTrail delivery, when the critical missing permission is s3:PutObject on the bucket objects ARN.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Missing s3:PutObject permission for the bucket.

For CloudTrail to deliver logs to an S3 bucket, the bucket policy must grant CloudTrail the s3:PutObject permission on the bucket's objects (the /* ARN), in addition to s3:GetBucketAcl on the bucket itself. The exhibit's policy is missing the s3:PutObject statement, so CloudTrail cannot write log files even though it can check the bucket ACL. This is the most likely missing permission.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Missing s3:GetBucketAcl permission.
Why it's wrong here
The policy already includes s3:GetBucketAcl.
✗
The condition StringEquals should be StringLike.
Why it's wrong here
StringLike supports wildcards for prefix matching, but CloudTrail's bucket policy requires StringEquals on aws:SourceArn to pin the exact trail ARN; switching operators would loosen, not add, permission. StringLike is correct when matching variable or pattern-based ARN values.
✓
Missing s3:PutObject permission for the bucket.
Why this is correct
CloudTrail delivers log files by writing objects into the bucket, so the bucket policy must grant the CloudTrail service principal s3:PutObject on the target prefix. Without that write action, delivery fails regardless of ACLs or ownership controls, which only govern access to objects already written.
✗
The bucket ARN is incorrect.
Why it's wrong here
An incorrect bucket ARN is a malformed resource reference, not a missing permission; CloudTrail's delivery failure stems from the absent s3:GetBucketAcl or PutObject grants. Verifying ARNs is worthwhile when the policy otherwise contains the required actions and principals.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

Timed practice sets

Quick scored rounds with instant marking and a written explanation per question.

SCS-C02 Practice Test 3 — 25 Questions→Free SCS-C02 Practice Test 1 — 30 Questions→

Domain-focused practice

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Security Logging and Monitoring Management and Security Governance Infrastructure Security

Practice by question type

Practise one question format at a time: exhibits, multi-select, drag-and-drop, troubleshooting.

Browse scenarios

Topic-level practice

Each topic page collects the questions that test one concept, plus the theory behind it.

Security Logging and Monitoring practice questions SCS-C02 fundamentals practice questions Identity and Access Management practice questions

Continue studying

Study guide Exam domains AWS Certified Security Specialty SCS-C02 exam guide

This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.

SCS-C02 Security Logging and Monitoring Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question