SCS-C02 Question 383
Select 3An organization is using AWS CloudTrail to monitor API activity in their AWS account. To enhance the security of their logs, they want to ensure that all CloudTrail log files stored in an S3 bucket are encrypted using server-side encryption with AWS Key Management Service (KMS) keys. Additionally, they want to prevent unauthorized deletion of these log files. Which combination of actions should the organization take to meet these requirements?
- A
Enable server-side encryption (SSE-KMS) in the CloudTrail configuration and specify the KMS key ARN.
- B
Set up an S3 bucket policy that denies delete actions unless they come from a specific IAM role.
- C
Enable versioning on the S3 bucket used for CloudTrail log storage.
- D
Create an S3 Lifecycle policy to automatically delete old CloudTrail logs after 90 days.
- E
Use AWS Config to monitor changes to the S3 bucket's server-side encryption settings.
Show answer and explanation
Correct answers: A, B, C
Explanation
To enhance the security of CloudTrail logs, the organization must use SSE-KMS to encrypt log files, restrict unauthorized delete actions via an S3 bucket policy, and enable versioning to ensure log file recovery in case of accidental or unauthorized deletion. These steps collectively ensure both encryption and durability of the log data.
- A. Correct.
Correct. Enabling SSE-KMS in the CloudTrail configuration ensures that the logs are encrypted using the specified KMS key.
- B. Correct.
Correct. Setting an S3 bucket policy that denies delete actions unless they come from a specific IAM role can help prevent unauthorized deletion of log files.
- C. Correct.
Correct. Enabling versioning on the S3 bucket ensures that even if a log file is deleted, previous versions of the log file are preserved.
- D. Incorrect.
Incorrect. Creating a Lifecycle policy to delete logs does not enhance security and contradicts the requirement to prevent unauthorized deletion.
- E. Incorrect.
Incorrect. While AWS Config can monitor settings, it does not prevent unauthorized deletion or directly enforce encryption requirements.