SCS-C02 Question 168
Select 4A financial institution is using AWS CloudTrail to monitor API activity across its AWS accounts. To meet compliance requirements, the security team must ensure that CloudTrail logs are encrypted, protected from accidental deletion, and cannot be overwritten by unauthorized users. Which combination of actions will meet this requirement?
- A
Enable default encryption for the S3 bucket storing CloudTrail logs.
- B
Configure the S3 bucket policy to deny delete actions on the CloudTrail logs by unauthorized principals.
- C
Enable S3 versioning on the bucket storing CloudTrail logs.
- D
Enable CloudTrail log file integrity validation.
- E
Use AWS Key Management Service (KMS) to implement server-side encryption for the CloudTrail logs.
Show answer and explanation
Correct answers: B, C, D, E
Explanation
To meet compliance requirements for CloudTrail logs, multiple actions are necessary: (1) Using AWS KMS for encryption ensures robust key management and security, (2) Configuring the S3 bucket policy to deny delete actions protects logs from unauthorized deletion, (3) Enabling S3 versioning ensures logs are not accidentally overwritten and can be recovered if needed, and (4) Enabling CloudTrail log file integrity validation ensures that any tampering with the logs can be detected. Default encryption alone does not provide the necessary security or compliance controls.
- A. Incorrect.
Incorrect. Default encryption is not sufficient to meet compliance or security requirements as it does not provide control over encryption keys or prevent unauthorized access.
- B. Correct.
Correct. Configuring an S3 bucket policy to deny delete actions prevents accidental or unauthorized deletion of logs, ensuring compliance with security best practices.
- C. Correct.
Correct. Enabling S3 versioning ensures that previous versions of the logs are preserved, which protects against accidental overwrites and data loss.
- D. Correct.
Correct. Enabling CloudTrail log file integrity validation ensures the logs have not been tampered with, which is a critical compliance requirement.
- E. Correct.
Correct. Using AWS KMS for server-side encryption provides fine-grained control over encryption keys and enhances the security of the CloudTrail logs.