SCS-C02 Question 137
Select 3Your organization has recently enabled AWS CloudTrail to monitor API activity in your AWS account. Compliance requires that all log files be retained for 7 years. You also need to optimize cost by automatically transitioning older logs to a cheaper storage class after 30 days. Which combination of actions will help you meet these requirements?
- A
Configure an S3 bucket as the log destination for AWS CloudTrail.
- B
Set up an S3 Lifecycle policy to transition logs to Amazon S3 Glacier after 30 days.
- C
Enable log file validation for CloudTrail logs.
- D
Set up an S3 Lifecycle policy to delete logs older than 7 years.
- E
Use AWS Config to monitor and enforce the S3 bucket's lifecycle policy.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet the compliance requirement of retaining logs for 7 years while optimizing costs, you must configure an S3 bucket as the CloudTrail log destination. Then, use an S3 Lifecycle policy to transition logs to S3 Glacier after 30 days, which reduces costs, and configure another lifecycle rule to delete logs older than 7 years to avoid unnecessary storage costs. Log file validation and AWS Config are not directly relevant to this specific requirement.
- A. Correct.
Correct: AWS CloudTrail logs must be stored in an S3 bucket to enable long-term storage and lifecycle management.
- B. Correct.
Correct: Configuring a Lifecycle policy to transition logs to Amazon S3 Glacier after 30 days helps reduce storage costs while retaining compliance data.
- C. Incorrect.
Incorrect: Log file validation ensures log integrity but does not help with retention or cost optimization.
- D. Correct.
Correct: Setting up a Lifecycle policy to delete logs after 7 years ensures compliance with retention requirements while managing storage costs.
- E. Incorrect.
Incorrect: AWS Config monitors configuration changes but is not required to enforce lifecycle policies in S3 buckets.