SCS-C02 Question 76
Single answerAn organization is using Amazon S3 to store sensitive customer data. They want to capture detailed access records for auditing purposes and ensure their compliance requirements are met. Which mechanism should they use to accomplish this?
- A
Enable S3 Server Access Logging to log all access requests made to the bucket
- B
Enable CloudTrail data events for the S3 bucket to capture API activity
- C
Use AWS Config to monitor changes to the S3 bucket's configuration
- D
Activate S3 Event Notifications to log access events in real time
Show answer and explanation
Correct answer: B
Explanation
To capture detailed access records for auditing purposes, enabling CloudTrail data events for the S3 bucket is the most appropriate choice. This feature provides detailed API activity logs, including object-level operations, which are essential for compliance and security auditing. While other options may provide some level of logging or monitoring, only CloudTrail data events deliver the necessary granularity for sensitive data access tracking.
- A. Incorrect.
S3 Server Access Logging provides logs about requests made to the S3 bucket, but it does not offer the granularity or detail needed for auditing API activity specific to sensitive data.
- B. Correct.
CloudTrail data events for S3 capture detailed API activity, such as object-level operations, which is essential for auditing and meeting compliance requirements.
- C. Incorrect.
AWS Config is used to track configuration changes to AWS resources and does not provide access request logs or API activity details for S3 buckets.
- D. Incorrect.
S3 Event Notifications are designed to trigger workflows or actions based on S3 events, but they are not a logging mechanism for detailed access or API activity.