DEA-C01 Question 505
Select 2You are a data engineer for a financial organization that must comply with strict regulatory requirements for audit logging. The security team has asked you to ensure that all application logs are securely stored, immutable, and can be easily retrieved for audits. Which combination of AWS services and features should you use to meet these requirements?
- A
Store logs in Amazon S3 with S3 Object Lock enabled in Compliance mode.
- B
Enable CloudTrail and configure it to deliver logs to an S3 bucket with versioning enabled.
- C
Use Amazon CloudWatch Logs with log retention policies set to 'Never Expire'.
- D
Enable AWS Config to track changes and deliver configuration snapshots to an S3 bucket.
- E
Set up AWS Lambda to process and encrypt logs before storing them in Amazon RDS.
Show answer and explanation
Correct answers: A, B
Explanation
To prepare logs for audits, it is crucial to ensure their immutability, security, and retrievability. Using Amazon S3 with S3 Object Lock in Compliance mode guarantees logs cannot be altered or deleted. Additionally, CloudTrail captures detailed AWS activity logs and delivers them to S3, where versioning ensures logs are preserved. These features together provide a robust solution to meet audit and compliance requirements.
- A. Correct.
Correct: S3 Object Lock in Compliance mode ensures that logs are immutable and cannot be deleted or altered, meeting audit requirements.
- B. Correct.
Correct: CloudTrail provides detailed logging of AWS API calls and can deliver logs to S3 buckets for long-term storage. Enabling versioning ensures logs are preserved even if overwritten.
- C. Incorrect.
Incorrect: While CloudWatch Logs supports log retention, it does not ensure immutability, which is a key compliance requirement for audits.
- D. Incorrect.
Incorrect: AWS Config tracks resource configurations but does not serve as a solution for application log storage and immutability.
- E. Incorrect.
Incorrect: While encrypting logs with Lambda is possible, storing them in Amazon RDS is not ideal for long-term, immutable, and cost-effective storage.