SCS-C02 Question 365
Select 2Your company is storing critical documents in an Amazon S3 bucket, and you need to implement a mechanism to ensure the integrity of these files. The solution must verify that no file has been tampered with or corrupted during upload or storage. Which of the following approaches can you use to meet this requirement?
- A
Use S3 Object Lock in Governance mode to prevent changes to the files.
- B
Generate and store a SHA-256 hash of each file at the time of upload and compare it during retrieval.
- C
Enable S3 Versioning to track changes to the files.
- D
Sign the files with a digital signature at the time of upload and verify the signature during retrieval.
- E
Enable AWS CloudTrail to log all API activity on the S3 bucket.
Show answer and explanation
Correct answers: B, D
Explanation
To ensure file integrity in S3, hashing algorithms (e.g., SHA-256) and digital signatures are effective techniques. Hashing allows you to detect any changes to the file by comparing its hash value, while digital signatures provide both integrity verification and proof of authenticity. S3 Object Lock, Versioning, and CloudTrail are useful for other security purposes but do not directly verify file integrity.
- A. Incorrect.
S3 Object Lock in Governance mode prevents unauthorized deletions or overwrites of files but does not verify the integrity of the files themselves.
- B. Correct.
Generating and storing a SHA-256 hash at upload allows you to verify the file's integrity later by comparing the stored hash with the hash of the retrieved file. This ensures the file has not been tampered with or corrupted.
- C. Incorrect.
S3 Versioning helps track changes to objects by retaining multiple versions, but it does not provide a way to verify the integrity of a specific file version.
- D. Correct.
Digital signatures not only verify the file's integrity but also provide proof of authenticity. Signing the file at upload and verifying the signature during retrieval ensures the file has not been tampered with.
- E. Incorrect.
AWS CloudTrail logs API activity, which can help in auditing and detecting unauthorized access, but it does not verify the integrity of the files in S3.