SCS-C02 Question 236
Select 2An organization wants to improve its security posture by implementing enhanced logging and monitoring for its AWS environment. They have enabled AWS CloudTrail, but they want to ensure the logs are protected from accidental or malicious deletion. What steps should they take to secure the CloudTrail logs stored in an S3 bucket?
- A
Enable S3 bucket versioning for the bucket storing CloudTrail logs.
- B
Attach an S3 bucket policy that denies delete actions for all users, including administrators.
- C
Use AWS Key Management Service (KMS) to encrypt the S3 bucket storing CloudTrail logs.
- D
Enable the S3 Object Lock feature in compliance mode for the bucket storing CloudTrail logs.
- E
Configure a lifecycle policy to automatically delete logs after 30 days.
Show answer and explanation
Correct answers: A, D
Explanation
To secure CloudTrail logs stored in S3, enabling bucket versioning ensures that previous versions of logs are retained even if they are deleted or modified. Additionally, enabling S3 Object Lock in compliance mode ensures the logs cannot be deleted or modified during the retention period, making them tamper-proof. These measures protect the logs from accidental or malicious deletion while adhering to security and compliance requirements.
- A. Correct.
Enabling S3 bucket versioning ensures that previous versions of objects are retained even if they are deleted or overwritten, protecting the integrity of the logs.
- B. Incorrect.
Denying delete actions for all users, including administrators, may not be practical or recommended because administrators may need access for legitimate reasons. Instead, fine-grained access control should be applied.
- C. Incorrect.
While encrypting the S3 bucket with AWS KMS enhances data security, it does not prevent accidental or malicious deletion of logs.
- D. Correct.
Enabling the S3 Object Lock feature in compliance mode ensures that the objects cannot be deleted or overwritten for a specified retention period, meeting the requirement to protect the logs.
- E. Incorrect.
Configuring a lifecycle policy to delete logs after 30 days contradicts the goal of retaining logs for security and compliance purposes.