SCS-C02 Question 382
Single answerYour company has deployed an application in AWS that stores sensitive customer data in an Amazon S3 bucket. Compliance requirements mandate that all data stored in this bucket must be encrypted at rest and access logs must be captured for auditing purposes. An external audit reveals that while server-side encryption has been enabled, there are no access logs available. How can you address this issue while ensuring compliance with the requirements?
- A
Enable S3 server access logging on the bucket and configure a target bucket to store the logs.
- B
Use AWS CloudTrail to enable logging for the S3 bucket and store the logs in Amazon S3 Glacier for long-term retention.
- C
Enable S3 Object Lock on the bucket to ensure that access logs cannot be deleted.
- D
Configure an AWS Config rule to ensure that all S3 buckets have server access logging enabled.
Show answer and explanation
Correct answer: A
Explanation
To meet compliance requirements for capturing access logs, you must enable S3 server access logging on the bucket and specify a target bucket to store the logs. This ensures that all access requests to the bucket are logged for audit purposes. AWS CloudTrail and S3 Object Lock do not meet the requirement to generate access logs, and AWS Config can only detect non-compliance but cannot enable logging by itself.
- A. Correct.
Correct: Enabling S3 server access logging and specifying a target bucket ensures that access logs are generated and stored for auditing purposes, fulfilling compliance requirements.
- B. Incorrect.
Incorrect: AWS CloudTrail logs API-level activities but does not capture S3 access logs. It is not a substitute for S3 server access logging.
- C. Incorrect.
Incorrect: S3 Object Lock is used for write-once-read-many (WORM) storage, and it does not enable or manage access logging.
- D. Incorrect.
Incorrect: While an AWS Config rule can help ensure compliance by flagging buckets without access logging, it does not enable logging itself. You must manually enable logging on the bucket.