SCS-C02 Question 84
Single answerYour company uses Amazon S3 for storing sensitive data. To meet compliance requirements, you must enable logging and monitoring to detect unauthorized access and ensure all access logs are retained for auditing purposes. Which solution provides the most comprehensive logging and monitoring for this use case?
- A
Enable S3 Server Access Logs and configure the logs to be stored in a separate S3 bucket with restricted access.
- B
Enable AWS CloudTrail data events for the S3 bucket to capture detailed object-level API activity.
- C
Use AWS Config to monitor changes to the S3 bucket's bucket policy and configuration settings.
- D
Enable Amazon Macie to classify sensitive data and monitor for anomalies in S3 bucket access patterns.
Show answer and explanation
Correct answer: B
Explanation
To meet the compliance requirements for logging and monitoring access to sensitive data in S3, enabling AWS CloudTrail data events is the most comprehensive solution. It captures detailed object-level API actions, such as GetObject and PutObject, which provides the necessary visibility into unauthorized access and supports auditing purposes. While other options like S3 Server Access Logs or Amazon Macie provide valuable features, they do not fulfill the requirement for detailed monitoring of object-level activity.
- A. Incorrect.
Enabling S3 Server Access Logs provides basic access logging for requests made to the bucket, but it does not capture detailed object-level API activity such as GetObject or PutObject. This option alone does not meet the compliance requirement for detailed monitoring.
- B. Correct.
Enabling AWS CloudTrail data events for the S3 bucket captures detailed object-level activity, such as which IAM principal accessed specific objects, providing comprehensive logging and monitoring. This is the most appropriate solution for this scenario.
- C. Incorrect.
AWS Config is useful for monitoring changes to the bucket's policies and configurations but does not provide detailed access logs or object-level monitoring as required in this scenario.
- D. Incorrect.
Amazon Macie is excellent for data classification and anomaly detection but does not provide detailed access logging or object-level API activity monitoring, which is the primary requirement in this scenario.