A company needs to log object-level activity in its Amazon S3 buckets. The company also needs to validate the integrity of the log file by using a digital signature. Which solution will meet these req

Question

Options

• ACreate an AWS CloudTrail trail with log file validation enabled. Enable data events. Specify
• BCreate a new S3 bucket for S3 server access logs. Configure the existing S3 buckets to send
• CCreate an Amazon CloudWatch Logs log group. Configure the existing S3 buckets to send their
• DCreate a new S3 bucket for S3 server access logs with log file validation enabled. Enable data

• A
  77% (17)
• B
  9% (2)
• C
  5% (1)
• D
  9% (2)

Explanation

AWS CloudTrail is the only AWS service that provides both object-level (data event) logging for S3 and cryptographic log file validation via SHA-256 hash digests and digital signatures - making option A the correct choice. Options B and D describe S3 Server Access Logs, which record bucket-level HTTP requests but have no log file validation or integrity feature - the "log file validation enabled" phrasing in D is a trap, since that feature belongs to CloudTrail, not S3 server access logging. Option C describes CloudWatch Logs, which can receive certain S3 notifications but is not a mechanism for logging object-level API activity (GetObject, PutObject, DeleteObject) and has no built-in digital signature validation for log integrity.

Memory tip: Think "CT = Certified Trustworthy" - CloudTrail is the service that gets you Certified (validated/signed) logs and Trustworthy (data event) audit trails. Any answer that pairs "log file validation" with S3 server access logs is a decoy, since that feature is exclusive to CloudTrail.

No community discussion yet for this question.