SOA-C02 Security and Compliance Practice Question
A SysOps administrator needs to ensure that all API calls made to AWS are logged for auditing purposes. Which AWS service should be enabled to capture management events?
⚠ Common exam trap
SOA-C02 often tests the distinction between services that log API activity (CloudTrail) and those that log network traffic (VPC Flow Logs) or resource access (S3 server access logs). Candidates may incorrectly choose CloudWatch Logs because it sounds like a logging service, but it does not capture API calls natively.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail is the service specifically designed to record API activity in an AWS account, including management events (control plane operations) such as creating, modifying, or deleting resources. It captures the identity of the caller, the time of the call, the source IP address, and other details, making it the correct choice for auditing API calls. CloudTrail logs can be delivered to an S3 bucket and optionally to CloudWatch Logs for further analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is the correct service because it records API activity across all AWS services, capturing the identity of the caller, the time of the call, the source IP address, and the user agent. Management events are logged and can be delivered to an S3 bucket or CloudWatch Logs for governance, compliance, and operational auditing. CloudTrail is specifically designed to answer 'who did what and when' at the API level, making it the authoritative audit trail for API calls in an AWS account.
- ✗
S3 server access logs
Why it's wrong here
S3 server access logs are incorrect because they only log requests directed at S3 buckets, such as object-level GET, PUT, and DELETE operations, and they do not capture API calls made to other AWS services. These logs are generated at the S3 service level and provide detailed records of S3 access patterns, but they do not give a comprehensive account-wide view of control-plane or management activity. Since the requirement is for all API calls across the account, S3 server access logs cannot satisfy the auditing need.
- ✗
VPC Flow Logs
Why it's wrong here
VPC Flow Logs capture IP traffic metadata at the network interface level, not the API-call-level management events required by the question. This option is tempting because network logs are commonly used for security auditing, and VPC Flow Logs do record communication patterns. However, they would be the correct choice only if the requirement were to log network traffic flows—such as source/destination IPs and ports—rather than the API operations performed by users or services.
- ✗
Amazon CloudWatch Logs
Why it's wrong here
CloudWatch Logs captures application and system log data, not the AWS API call records required for auditing management events; the correct service, AWS CloudTrail, specifically records API activity and governance events. It is tempting because CloudWatch Logs is commonly used for monitoring and troubleshooting, and in scenarios where you need to centralise log files from applications or EC2 instances for analysis, it would be the correct choice.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.