SOA-C02 Monitoring, Logging, and Remediation Practice Question
A company uses AWS CloudTrail to log API activity. A SysOps administrator discovers that some management events are not being logged. The administrator checks the CloudTrail configuration and confirms that management events are enabled and logging is working for most events. What is the most likely cause of the missing events?
⚠ Common exam trap
The trap here is that candidates often overlook the region scope of CloudTrail and assume that enabling management events globally means all regions are covered, but a single-region trail only captures events from its designated region.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The trail is configured to log events only for a single region, and the missing events occurred in a different region
CloudTrail trails can be configured to log events for a single region or all regions. If the trail is set to log only one region, management events occurring in any other region will not be captured. Since the administrator confirmed management events are enabled and logging works for most events, the most likely cause is that the missing events originated from a region not covered by the trail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The trail excludes specific management events based on read/write filtering
Why it's wrong here
Read/write filtering on a CloudTrail trail controls whether read-only, write-only, or both management event types are logged. Enabling such a filter would suppress only the chosen category of events, not all missing events, and the filtering setting is applied uniformly across all regions and services. The described missing events are not the result of this filtering because the filter does not exclude specific API actions outside its read/write classification.
- ✗
The trail is logging only data events for S3
Why it's wrong here
If the trail were logging only S3 data events, it would capture object-level activity such as GetObject or PutObject, while management events like IAM or EC2 calls would be entirely absent. The problem refers to missing API activity, but not a complete absence of all management events, which would be the case if management events were disabled. Even if S3 data events are enabled, management events are a separate category that can be logged independently, so this option does not explain the selective missing events.
- ✓
The trail is configured to log events only for a single region, and the missing events occurred in a different region
Why this is correct
By default, a CloudTrail trail logs events only in the region where it was created unless you explicitly configure it to log all regions. When a trail is single-region, any API activity occurring in other AWS regions is not captured, while events in the trail's home region are still logged normally. This matches the scenario of missing events if those events occurred outside the trail's configured region.
- ✗
The missing events are from unsupported services
Why it's wrong here
CloudTrail supports management event logging for all AWS services that integrate with it, and this support is not a common cause of missing API activity. Every AWS service that performs API calls does so through the CloudTrail-supported endpoints for management events, so unsupported services would not exist for standard API activity. If a service were genuinely unsupported, none of its events would ever appear in the trail, but the question's missing events are selective, not a complete absence for a particular service.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS CloudTrail to log API calls across all regions. The SysOps administrator notices that logs for a specific region are missing from the centralized S3 bucket. What is the most likely cause?
medium- ✓ A.The CloudTrail trail is not enabled for that region.
- B.The S3 bucket policy denies write access from CloudTrail for that region.
- C.CloudTrail log file validation is disabled.
- D.The IAM role for CloudTrail does not have permissions to write logs from that region.
Why A: CloudTrail trails can be configured to log API calls from specific regions or all regions. If logs for a particular region are missing from the centralized S3 bucket, the most likely cause is that the trail was not enabled for that region during trail creation or update. By default, a trail applied to all regions will automatically log activity from every region, but if the trail is configured for a single region or a subset, other regions will not have their logs delivered.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.