SCS-C02 Question 390
Select 3Your organization operates in a regulated industry and must comply with data retention standards that mandate retaining logs for seven years. You are tasked with designing a solution for storing and managing log data in AWS to meet these requirements. Which combination of solutions will address these requirements while ensuring cost efficiency and security?
- A
Store the logs in Amazon S3 with a lifecycle policy to transition them to S3 Glacier after 30 days.
- B
Enable default encryption on the S3 bucket to encrypt logs at rest.
- C
Use AWS Backup to create daily backups of the logs and store them in a different AWS Region.
- D
Implement an S3 Object Lock policy with a retention period of seven years to ensure logs cannot be deleted prematurely.
- E
Enable logging on the S3 bucket and store the bucket access logs in the same bucket as the log data.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet data retention requirements while ensuring cost efficiency and security, logs should be stored in Amazon S3 with a lifecycle policy to transition them to S3 Glacier for long-term, low-cost storage. Enabling encryption ensures that the logs are protected at rest, and implementing S3 Object Lock guarantees compliance by preventing premature deletion or modification of the logs. These measures collectively meet regulatory requirements and AWS best practices for secure and cost-efficient log retention.
- A. Correct.
This option ensures cost efficiency by transitioning older logs to the cost-effective S3 Glacier storage class while still meeting retention requirements.
- B. Correct.
Enabling default encryption ensures that logs are securely encrypted at rest, which is critical for compliance with data security standards.
- C. Incorrect.
AWS Backup is designed for backups, not for long-term log retention. It is also not the most cost-effective solution for this use case.
- D. Correct.
S3 Object Lock with a retention period of seven years ensures the immutability and compliance of the stored logs by preventing premature deletion.
- E. Incorrect.
While logging bucket access is good for tracking access patterns, storing access logs in the same bucket as the log data is not a best practice and does not address retention or cost efficiency.