SOA-C02 Question #29: Real Exam Question with Answer & Explanation

Question

A SysOps administrator has noticed millions of LIST requests on an Amazon S3 bucket. Which services or features can the administrator use to investigate where the requests are coming from? (Choose two.)

Options

• AAWS CloudTrail data events
• BAmazon EventBridge
• CAWS Health Dashboard
• DAmazon S3 server access logging
• EAWS Trusted Advisor

Explanation

AWS CloudTrail data events (A) capture API-level activity on S3 objects and buckets - including LIST operations - and record the caller identity, IP address, and timestamp, making it ideal for tracing who is making requests. Amazon S3 server access logging (D) records detailed request logs (including LIST requests) directly to another S3 bucket, providing a lightweight, built-in way to audit access patterns.

Why the distractors are wrong:

• B (EventBridge): Reacts to events and routes them to targets - it doesn't provide historical request investigation or logging.
• C (AWS Health Dashboard): Shows service health and outages affecting your account, not request-level traffic details.
• E (Trusted Advisor): Offers best-practice recommendations (cost, security, performance) but does not log or analyze S3 request origins.

Memory tip: Think "who's knocking on my S3 door?" - CloudTrail catches the identity (who/what called the API), and S3 server access logs catch the footprints (raw HTTP-level request details). Both answer "where are requests coming from?" from complementary angles. If a choice doesn't log requests, it won't help you investigate them.

No community discussion yet for this question.