AWS Certified SysOps Administrator Practice Exam

Which method can verify unauthorized access attempts to an S3 bucket without alerting users?

1. Enable CloudTrail logging

2. Enable S3 Access Logs

3. Review IAM policy changes

4. Use Amazon VPC Flow Logs

The correct answer is: Enable S3 Access Logs

Enabling S3 Access Logs is the most effective method to verify unauthorized access attempts to an S3 bucket without alerting users. When S3 Access Logging is enabled, it provides detailed records for the requests made to an S3 bucket. This includes information about the requester, bucket name, request time, action type, and error codes, among other details. The logs are stored in an S3 bucket that you specify and can be reviewed later to look for signs of unauthorized access or suspicious activity. Since this logging occurs after the requests are made and does not proactively alert users, it allows for quiet monitoring and analysis of bucket access patterns. In contrast, other options like enabling CloudTrail logging, while useful for tracking API calls in AWS, also involves logging activities that users may be aware of, which could lead to alerts. Reviewing IAM policy changes focuses on the configuration and permissions aspect rather than direct access attempts. Using Amazon VPC Flow Logs tracks IP traffic and is more suited for network-level monitoring rather than direct object access to S3. Thus, enabling S3 Access Logs provides the necessary insights into access attempts without notifying users.