CloudTrail log files in S3 are being read by an unexpected IAM principal. Which log source reveals the GetObject calls against the CloudTrail bucket?

Show answer and explanation

Answer: A

Object-level reads on the log bucket, such as GetObject, appear only in S3 data events. Enabling data events for that bucket, often through a dedicated trail, captures who accessed the log files and when. Management events would show changes to trail configuration but not the reads themselves.

Why the other options are wrong

B. Flow logs show network connections to S3 endpoints, not which principal called GetObject on which object.
C. Config tracks bucket configuration and compliance, not object read activity.
D. Budgets alerts on spend thresholds and is unrelated to access auditing.

Keep going. 330 SCS-C03 questions, answers explained after each one.

Practise this domain

A container platform team notices a shell process spawned inside a running pod that opened an outbound connection to an unknown host, which is typical of an attacker gaining interactive access. Which threat detection capability watches process and file behavior inside running workloads to catch this?
A development VPC needs flow records only for denied traffic, stored as cheaply as possible, and the team will query them occasionally with SQL. Which delivery configuration is most economical?
A security team must retain CloudTrail management events for seven years in a queryable store while minimizing operational overhead. Which approach best meets this requirement?
A company enabled a CloudTrail organization trail. Where are management events from member accounts delivered?

Reviewed November 2026. Spotted a problem with this question? Report it from the practice tool.

CloudTrail log files in S3 are being read by an unexpected IAM principal. Which log source reveals the GetObject calls against the CloudTrail bucket?

Why the other options are wrong

More on threat detection and monitoring