SCS-C02 Data Protection Practice Question
Which TWO AWS services can be used to monitor and audit data access patterns to Amazon S3 buckets? (Choose 2.)
⚠ Common exam trap
Many candidates confuse AWS Config (which checks configuration compliance) with CloudTrail (which records API activity), or they overlook that S3 Server Access Logs are a separate, native logging feature distinct from CloudTrail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail (C) is correct because it records S3 data-plane API calls such as GetObject and PutObject when data events are enabled, providing an audit trail of who accessed which objects and when. Amazon S3 Server Access Logs (D) is correct because S3 can deliver detailed, per-request access records (requester, bucket, operation, HTTP status, bytes) directly to a target bucket for auditing access patterns. AWS Config (A) tracks resource configuration changes and compliance, not object-level data access patterns. AWS CloudWatch (B) provides metrics, logs, and alarms but does not natively audit S3 object access requests. AWS Trusted Advisor (E) offers best-practice checks and recommendations, not access auditing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config records resource configuration changes and compliance, not individual object read or write requests. It is tempting because it evaluates S3 bucket policies and settings, which would be the right choice for detecting configuration drift rather than auditing data access.
- ✗
AWS CloudWatch
Why it's wrong here
CloudWatch holds metrics and log events, not S3 data-access records; it cannot report who read which object. It is tempting because it monitors S3 bucket metrics and can trigger alarms, which would suit operational monitoring rather than auditing access patterns.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail records S3 data events such as GetObject and PutObject, capturing the identity, source IP, timestamp and request details for each object-level API call. This satisfies the requirement to audit who accessed which objects, provided data events are explicitly enabled on the trail.
- ✓
Amazon S3 Server Access Logs
Why this is correct
Amazon S3 Server Access Logs record request-level details for every access to a bucket, including requester, operation, response code and bytes transferred, delivered as log objects. This satisfies the requirement to monitor access patterns without needing CloudTrail data events enabled.
- ✗
AWS Trusted Advisor
Why it's wrong here
Trusted Advisor inspects account-wide best-practise checks such as S3 bucket permissions and logging status, not per-object access events. It is tempting because it flags publicly accessible buckets, which would be the correct tool for a posture review rather than access-pattern auditing.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.