SOA-C02 Monitoring, Logging, and Remediation Practice Question

A SysOps administrator needs to track changes made to an Amazon S3 bucket policy and receive notifications when changes occur. Which AWS service should be used?

⚠ Common exam trap

The trap is confusing CloudTrail (API activity logging) with AWS Config (configuration change tracking); candidates often pick CloudTrail because it 'tracks changes', but it does not provide configuration state or compliance notifications.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS Config

AWS Config is designed to record configuration changes to AWS resources, including S3 bucket policies, and can evaluate them against desired configurations. It can send notifications via Amazon SNS when changes occur, and it provides a history of configuration changes. This directly meets the requirement to track changes and receive notifications.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor is a service that inspects your AWS environment and provides recommendations across categories like cost optimization, performance, security, and fault tolerance. It does not maintain a history of configuration changes or provide event notifications when a resource such as an S3 bucket policy is modified. While Trusted Advisor may flag security findings like publicly accessible buckets, it is not a change-tracking or auditing mechanism and therefore cannot fulfill the requirement to track changes and receive notifications.
✗
Amazon CloudWatch Events
Why it's wrong here
Amazon CloudWatch Events does not natively monitor S3 bucket policy changes directly. These modifications are API calls logged by AWS CloudTrail, which is the service specifically designed for auditing configuration changes and API activity. CloudWatch Events is tempting as it processes events from AWS services, and it would be the correct choice for reacting to S3 *object-level* events, such as new object uploads, or other service state changes.
✓
AWS Config
Why this is correct
AWS Config is the correct choice because it continuously records and evaluates configuration changes to supported AWS resources, including S3 bucket policies. You can set up AWS Config rules to detect specific changes and configure Amazon SNS to send notifications when a resource deviates from a desired configuration or when a change occurs. It maintains a configuration history and timeline, enabling both auditing and alerting for modifications, which directly matches the requirement.
✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail records API activity in your account, including calls like PutBucketPolicy, but it is primarily an audit log of who made what call and when. CloudTrail does not natively trigger notifications when a configuration change occurs; you would need to build additional logic to process CloudTrail logs and send alerts. Since the question asks for change tracking with notifications, this is directly provided by AWS Config, not by simply logging API events.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SOA-C02 Monitoring, Logging, and Remediation Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question