SCS-C02 Question 367
Select 3An organization is using Amazon S3 to store important log files that must remain unchanged to meet compliance requirements. They want to ensure the integrity of these files by verifying that the files are not tampered with after they are uploaded. Which of the following approaches can help achieve this?
- A
Enable S3 Object Lock in compliance mode and calculate a hash of the file using a secure hashing algorithm (e.g., SHA-256) to verify integrity.
- B
Use Amazon Macie to monitor the integrity of the files and detect unauthorized changes.
- C
Generate and store a digital signature using a private key for each file after uploading, and verify using the corresponding public key.
- D
Enable S3 Versioning and periodically compare the hash of the current file version with the original file version.
- E
Configure an AWS Lambda function to automatically restore files to their original state if any changes are detected.
Show answer and explanation
Correct answers: A, C, D
Explanation
Ensuring integrity involves verifying that data has not been tampered with. Techniques such as hashing algorithms (e.g., SHA-256) and digital signatures are effective for integrity checking. S3 Object Lock in compliance mode prevents modifications during the retention period, while S3 Versioning allows you to compare different versions of files using hashes. These methods align with AWS best practices for securing data integrity in compliance-focused scenarios.
- A. Correct.
Correct: Enabling S3 Object Lock in compliance mode ensures that files cannot be deleted or modified during the retention period. Using a secure hash (e.g., SHA-256) to verify integrity ensures the file has not been tampered with.
- B. Incorrect.
Incorrect: Amazon Macie is a security service primarily designed for sensitive data discovery and classification, not for integrity monitoring or file tamper detection.
- C. Correct.
Correct: Generating a digital signature using a private key and verifying it with the corresponding public key ensures the authenticity and integrity of the file.
- D. Correct.
Correct: S3 Versioning allows you to retain multiple versions of an object. By comparing the hash of the current version with the hash of the original version, you can verify integrity.
- E. Incorrect.
Incorrect: Automatically restoring files using AWS Lambda does not verify integrity proactively. This approach also assumes that a tampered version will always be detected and replaced, which does not address the integrity-checking requirement.