DEA-C01 Question 508
Single answerYour company uses Amazon CloudTrail to log all API activity within their AWS account for audit purposes. The audit team requires logs to be stored securely for 10 years, and they must be easily accessible when needed. Additionally, the team requests that any tampering of logs be detectable. What is the most appropriate approach to meet these requirements?
- A
Store CloudTrail logs in an S3 bucket with versioning enabled and enable MFA Delete.
- B
Store CloudTrail logs in an S3 bucket and configure a lifecycle policy to transition objects to Amazon Glacier Deep Archive after 10 years.
- C
Store CloudTrail logs in an S3 bucket with default settings and use CloudWatch Logs for monitoring.
- D
Store CloudTrail logs in an S3 bucket with Amazon S3 Object Lock enabled in compliance mode.
Show answer and explanation
Correct answer: D
Explanation
To meet audit requirements for secure, long-term storage of CloudTrail logs while ensuring tamper detection, Amazon S3 Object Lock in compliance mode is the best solution. This feature enforces WORM (Write Once, Read Many) policies, prevents deletion or modification of logs during the retention period, and ensures compliance with regulatory requirements. Other options may provide some level of security but fail to guarantee compliance or tamper-proof storage.
- A. Incorrect.
This option is correct because enabling versioning and MFA Delete provides additional security for the logs, but it does not ensure that log tampering is detectable or enforce compliance retention policies.
- B. Incorrect.
This option is incorrect because transitioning logs to Amazon Glacier Deep Archive after 10 years does not meet the requirement for ensuring that tampering of logs is detectable or compliance retention is enforced.
- C. Incorrect.
This option is incorrect because the default S3 bucket settings do not provide tamper-proof storage, nor do they enforce compliance retention policies.
- D. Correct.
This option is correct because Amazon S3 Object Lock in compliance mode ensures that logs cannot be deleted or overwritten during the retention period, meeting the requirements for secure, tamper-proof storage and compliance.