ExpertMedium1 markMultiple Choice
AWS SAA-C03 · Question 09 · Domain 1.2: Secure Workloads
A company requires that all AWS API calls are logged. They also need to mathematically prove that the log files have not been tampered with after they were delivered to Amazon S3. How can this be achieved?
A company requires that all AWS API calls are logged. They also need to mathematically prove that the log files have not been tampered with after they were delivered to Amazon S3. How can this be achieved?
Answer options:
A.
Enable S3 Object Lock in compliance mode.
B.
Enable CloudTrail log file integrity validation.
C.
Encrypt the CloudTrail logs using AWS KMS.
D.
Use Amazon Macie to monitor the S3 bucket for changes.
How to approach this question
Look for the specific CloudTrail feature designed for mathematical proof of log integrity.
Full Answer
B.Enable CloudTrail log file integrity validation.✓ Correct
CloudTrail log file integrity validation uses industry-standard algorithms (SHA-256 and RSA) to create a hash for every log file delivered, allowing you to assert that no log files were modified or deleted.
Common mistakes
Choosing S3 Object Lock, which is for immutability but doesn't provide the mathematical proof feature CloudTrail offers natively.
Practice the full AWS SAA-C03 Practice Exam 5
65 questions · hints · full answers · grading
More questions from this exam
Q01A company needs to grant an external auditor read-only access to specific AWS resources. The audi...EasyQ02An application running on EC2 instances needs to access objects in an S3 bucket. The security tea...MediumQ03A company is designing a VPC for a multi-tier web application. They need to block specific malici...MediumQ04A large enterprise uses AWS Organizations to manage multiple accounts. The security team wants to...HardQ05A company hosts a web application on an Application Load Balancer (ALB). They are experiencing SQ...Medium