SCS-C02 Question 139
Select 2An organization is using CloudTrail to monitor API activity in their AWS environment. They want to ensure that the logs are retained for compliance purposes for 7 years and stored in a cost-effective manner. How can they achieve this using AWS services?
- A
Configure an S3 Lifecycle policy to transition CloudTrail logs to S3 Glacier after 30 days and delete them after 7 years.
- B
Enable log file validation in CloudTrail to ensure log integrity over the 7-year period.
- C
Store CloudTrail logs in Amazon S3 with Intelligent-Tiering storage class to optimize storage costs.
- D
Set up an S3 Lifecycle policy to delete CloudTrail logs after 7 years directly without transitioning them to a different storage class.
- E
Use AWS Config to automatically archive and retain CloudTrail logs for 7 years.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the 7-year retention requirement in a cost-effective manner, the organization can use S3 Lifecycle policies to transition logs to Glacier for archival storage and ensure they are deleted after the retention period. Additionally, enabling log file validation in CloudTrail ensures the integrity of the stored logs, which is crucial for compliance purposes.
- A. Correct.
This is correct. Using an S3 Lifecycle policy to transition logs to S3 Glacier reduces storage costs over time, and setting a deletion policy ensures compliance with the 7-year retention requirement.
- B. Correct.
This is correct. Enabling log file validation ensures the integrity of CloudTrail logs, which is often a compliance requirement for retained logs.
- C. Incorrect.
This is incorrect. While S3 Intelligent-Tiering optimizes cost for data with unpredictable access patterns, transitioning to S3 Glacier is more cost-effective for long-term storage requirements like 7 years.
- D. Incorrect.
This is incorrect. While a deletion policy is necessary, not transitioning the logs to a lower-cost storage class like S3 Glacier would result in higher costs over the retention period.
- E. Incorrect.
This is incorrect. AWS Config monitors configuration changes and compliance but does not handle log retention or lifecycle management for CloudTrail logs.