SOA-C02 Monitoring, Logging, and Remediation Practice Question

A SysOps administrator is investigating a security incident and needs to determine who deleted an S3 bucket. Which AWS service should be used to find this information?

⚠ Common exam trap

Many exam-takers confuse S3 server access logs (which log object-level requests) with CloudTrail (which logs management-plane API calls), leading them to incorrectly choose S3 server access logs for bucket deletion events.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS CloudTrail

AWS CloudTrail is the correct service because it records API activity across AWS services, including S3 bucket deletion events. When a user or role deletes an S3 bucket, CloudTrail logs the `DeleteBucket` API call with details such as the IAM user or role, source IP address, and timestamp, enabling the administrator to identify the responsible entity.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is the correct choice because it records management events, including the DeleteBucket API call, as part of its default audit trail. Each event captures the identity of the caller, the source IP address, the time of the action, and request parameters, which is exactly the evidence needed to investigate an unauthorized deletion. Since DeleteBucket is a control-plane operation, it appears in CloudTrail even if data-event logging is not configured.
✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor is not a logging or auditing service; it evaluates your account against best practices and provides recommendations in categories such as cost optimization, performance, security, and fault tolerance. It does not record or store API call history, and it has no visibility into who invoked DeleteBucket or when the call was made. Therefore, Trusted Advisor could not help determine the cause or perpetrator of the bucket deletion.
✗
S3 server access logs
Why it's wrong here
S3 server access logs are generated for object-level requests that are directed at a bucket, such as PUT, GET, and DELETE object operations, providing details about the requester and the action performed on a specific key. Deleting an entire bucket is a management API call that acts on the bucket resource itself, not on objects within it, so that action is not captured in server access logs. Additionally, if the bucket is deleted, the logs themselves would be stored elsewhere if configured, but they still would not include the DeleteBucket event.
✗
CloudWatch Logs for the S3 service
Why it's wrong here
CloudWatch Logs for the S3 service is not a native source of audit information; S3 does not automatically send API call logs to CloudWatch Logs. While CloudTrail can deliver recorded events to a CloudWatch Logs log group for monitoring and alerting, the log group simply stores the events forwarded by CloudTrail and cannot independently capture the DeleteBucket call. Without CloudTrail as the originator, CloudWatch Logs would contain no record of the bucket deletion.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SOA-C02 Monitoring, Logging, and Remediation Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question