SOA-C02 Security and Compliance Practice Question

A company requires that all API calls to AWS services be logged for compliance. The logs must be stored in a centralized S3 bucket with server-side encryption enabled. Which AWS service should be used to capture the API calls?

⚠ Common exam trap

SOA-C02 often tests the confusion between CloudTrail (API activity auditing) and AWS Config (resource configuration/compliance) or VPC Flow Logs (network traffic), especially when the question emphasizes 'API calls' and 'compliance.'

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS CloudTrail

AWS CloudTrail records API activity across AWS services, capturing who made what call, from where, and when, and can deliver logs to a centralized S3 bucket with SSE enabled. It is the designated service for auditing API calls for compliance.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
AWS Config
Why it's wrong here
AWS Config is a service for recording, evaluating, and auditing the configuration state of AWS resources over time. It detects changes to resource properties (e.g., an EC2 instance type or a security group rule) and can trigger rules for compliance, but it does not capture the API calls that caused those changes. For auditing who made a specific AWS API request, CloudTrail is the required service.
✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is the native AWS service designed to log all API activity in an account, including actions taken through the AWS Management Console, SDKs, CLI, and other services. Each event records the identity of the caller, the time of the call, the source IP address, and the request parameters. By enabling a trail, these logs can be delivered to Amazon S3 for long-term storage and integrated with CloudWatch Logs or third-party tools for monitoring and alerting.
✗
VPC Flow Logs
Why it's wrong here
VPC Flow Logs capture information about the IP traffic going to and from network interfaces in your VPC, such as source and destination IP addresses, ports, and protocol. This data is useful for network diagnostics and security analysis, but it operates at the network layer (OSI Layer 3/4) and does not log API requests. For example, a flow log would show traffic to an S3 endpoint but would not tell you which IAM principal or which API action was invoked — that is CloudTrail's domain.
✗
Amazon CloudWatch Logs
Why it's wrong here
Amazon CloudWatch Logs can ingest, store, and monitor log files from various sources, including application logs, AWS service logs, and even CloudTrail events if you configure a subscription. However, CloudWatch Logs is not the primary service that captures AWS API calls; it is a destination for logs generated elsewhere. Using CloudWatch Logs alone would not record API activity — you would need CloudTrail to create the events first before they can be streamed to CloudWatch Logs.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SOA-C02 Security and Compliance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question