SCS-C02 Management and Security Governance Practice Question
Network Topology
Refer to the exhibit. A security engineer runs the get-trail-status command for a CloudTrail trail. The engineer notices that LatestCloudWatchLogsDeliveryTime is null. What does this indicate?
⚠ Common exam trap
SCS-C02 often tests the distinction between S3 delivery fields and CloudWatch Logs delivery fields in get-trail-status, and candidates assume a null timestamp means logging is broken rather than that the specific integration is unconfigured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The trail is not configured to deliver logs to CloudWatch Logs.
LatestCloudWatchLogsDeliveryTime being null indicates the trail has never delivered logs to a CloudWatch Logs log group — in other words, CloudWatch Logs delivery is not configured for this trail. If delivery were configured and functioning, this field would contain the timestamp of the most recent delivery. A null value specifically means no delivery has occurred, not that delivery failed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The trail has stopped logging.
Why it's wrong here
The IsLogging field in the trail status is true, which explicitly indicates that the trail is currently enabled and actively recording API activity. A trail that has stopped logging would show IsLogging as false, and would also have a corresponding StopLogging event recorded. Therefore, this cannot be the reason for the issue.
- ✗
The trail is not delivering logs to S3.
Why it's wrong here
LatestDeliveryAttemptSucceeded is reported as SUCCEEDED, meaning CloudTrail's most recent attempt to deliver the log file to the configured S3 bucket completed without error. If delivery were failing, this status would be FAILED, and LatestDeliveryError would contain a message. Since the status shows success, S3 delivery is not the problem.
- ✗
The digest delivery has failed.
Why it's wrong here
LatestDigestDeliveryTime is populated, which proves that CloudTrail has recently delivered a digest file—the SHA-256 hash of log files used for integrity validation—to the S3 bucket. Digest delivery failure would be indicated by a null value or an error counter on that status field, not by a present timestamp. Thus, digest delivery has not failed.
- ✓
The trail is not configured to deliver logs to CloudWatch Logs.
Why this is correct
The absence of a CloudWatch Logs delivery timestamp (such as LatestCloudWatchLogsDeliveryTime) and the lack of a CloudWatch Logs log group ARN indicate the trail does not have the CloudWatch Logs integration enabled. Trail status returns these fields only when the trail is configured to send events to CloudWatch Logs, which requires an IAM role and explicit log-group setup. Therefore, the trail is not delivering to CloudWatch Logs.
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.