SCS-C02 Security Logging and Monitoring Practice Question
Which TWO actions should a security engineer take to ensure that CloudTrail logs are protected from unauthorized deletion? (Choose two.)
⚠ Common exam trap
Test-takers frequently confuse data protection mechanisms (encryption, versioning) with deletion prevention, leading them to select options like B or C instead of recognizing that only explicit deny policies and MFA Delete directly block deletion actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach an S3 bucket policy that denies s3:DeleteObject to all principals except the CloudTrail service principal.
Attaching an S3 bucket policy that denies s3:DeleteObject to all principals except the CloudTrail service principal prevents any user or role (including root) from deleting log files, while still allowing CloudTrail to write logs. This ensures that even if an attacker gains administrative access, they cannot delete the logs, preserving their integrity for forensic analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Attach an S3 bucket policy that denies s3:DeleteObject to all principals except the CloudTrail service principal.
Why this is correct
This bucket policy uses an explicit Deny for s3:DeleteObject scoped to all principals except the CloudTrail service principal (with conditions like aws:SourceArn to prevent misuse), which prevents any IAM user, role, or AWS account from deleting log objects. Because an explicit Deny overrides all Allows, this enforces immutability of the logs while still allowing CloudTrail to write new objects. This is a direct and robust control for preserving audit log integrity.
- ✗
Enable S3 versioning on the log bucket.
Why it's wrong here
Enabling S3 versioning on the log bucket does not actually block delete operations; a user with s3:DeleteObject can still issue a DeleteObject request, which either creates a delete marker or permanently removes a specific version if the version ID is specified. While versioning enables recovery of deleted versions, it does not prevent deletion from occurring in the first place, so an attacker can still remove logs temporarily or permanently if they know the version ID. Thus, versioning alone is an insufficient safeguard.
- ✗
Enable S3 default encryption with SSE-S3.
Why it's wrong here
Default encryption with SSE-S3 encrypts objects at rest using S3-managed keys, protecting the confidentiality of log data from unauthorized reads. However, encryption has no impact on authorization controls such as s3:DeleteObject or s3:PutObject; an entity with delete permission can still remove the encrypted objects. Therefore, SSE-S3 does not contribute to log persistence or deletion prevention.
- ✗
Configure CloudTrail to send logs to CloudWatch Logs.
Why it's wrong here
Delivering CloudTrail events to CloudWatch Logs creates a separate copyable destination, but it does not alter the permissions, lifecycle, or deletion behavior of the original S3 bucket. If the S3 log files are deleted, the CloudWatch copy contains only the events that were delivered before deletion and does not recover the deleted S3 objects. This option is a monitoring or delivery feature, not a deletion prevention control for the S3 bucket itself.
- ✓
Enable S3 MFA Delete on the log bucket.
Why this is correct
MFA Delete requires a second authentication factor to be passed in the x-amz-mfa header to permanently delete an object version or to change the bucket's versioning state, such as suspending versioning. This raises the bar for an attacker who has stolen AWS credentials but does not possess the hardware or virtual MFA device, making irrevocable deletion of log versions significantly harder. When combined with versioning, MFA Delete provides strong protection for CloudTrail log integrity.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.