SOA-C02 Monitoring, Logging, and Remediation Practice Question
A SysOps administrator needs to receive alerts when an S3 bucket is publicly accessible. Which TWO AWS services can be used to monitor and detect this configuration?
⚠ Common exam trap
Many candidates choose AWS Trusted Advisor (C) because it has a 'S3 Bucket Permissions' check, but they overlook that it does not provide real-time alerts or continuous monitoring, unlike AWS Config which can trigger immediate notifications via Amazon SNS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Security Hub
AWS Security Hub (B) is correct because it aggregates security findings from multiple AWS services, including Amazon GuardDuty and AWS Config, and can detect publicly accessible S3 buckets via its built-in security standards (e.g., CIS AWS Foundations Benchmark). AWS Config (D) is correct because it can evaluate S3 bucket configurations against rules, such as the managed rule 's3-bucket-public-read-prohibited' or 's3-bucket-public-write-prohibited', and trigger alerts when a bucket becomes publicly accessible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudTrail
Why it's wrong here
CloudTrail records API calls made to S3, including PutBucketPolicy, but it is an audit log, not an alerting service. To receive notifications from CloudTrail, you would need to create a separate CloudWatch Events rule or EventBridge pattern to filter for specific events. Thus, CloudTrail alone cannot directly send alerts when an S3 bucket policy changes; it only provides the raw event data.
- ✓
AWS Security Hub
Why this is correct
AWS Security Hub aggregates security findings from AWS Config rules and other integrated services, including custom or managed rules that detect S3 bucket policy changes. By enabling appropriate controls, you can use Security Hub's consolidated findings to trigger alerts via EventBridge or CloudWatch. This makes it suitable for receiving actionable alerts when a bucket policy is modified.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor performs periodic checks across your AWS environment (e.g., S3 bucket permissions, security groups) and reports the results on the Trusted Advisor dashboard. It does not provide real-time alerts upon every bucket policy change, nor does it continuously evaluate policy modifications like AWS Config does. Its alerts are limited to check status changes and are not designed for immediate event-driven notifications.
- ✓
AWS Config
Why this is correct
AWS Config continuously records S3 bucket configuration changes and evaluates them against rules, such as the managed rule for s3-bucket-policy-... or custom rules that flag non-compliant policies. When a bucket policy changes, Config can invoke a Lambda function or send a notification to an SNS topic, enabling real-time alerts. This is a direct and effective way to alert on bucket policy changes.
- ✗
Amazon CloudWatch
Why it's wrong here
Amazon CloudWatch monitors metrics and logs, but it does not natively observe S3 bucket policy content or changes. While you could send S3 data events to CloudWatch Logs via CloudTrail, that requires additional setup, and CloudWatch wouldn't directly assess bucket policy compliance. Therefore, CloudWatch is not the primary service for alerting on bucket policy changes; it serves as a metric/log monitoring layer.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,169 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.