SCS-C02 · Question #232
A company wants to start processing sensitive data on Amazon EC2 instances. The company will use Amazon CloudWatch Logs to monitor, store, and access log files from the EC2 instances. The company's…
The correct answer is A. Create a CloudWatch Logs account-wide data protection policy. Specify the appropriate data. AWS CloudWatch Logs now supports data protection policies that can be applied at the account level to automatically redact or mask sensitive data in logs. By creating an account-wide policy and specifying the appropriate data identifiers, sensitive data will be protected in all…
Question
A company wants to start processing sensitive data on Amazon EC2 instances. The company will use Amazon CloudWatch Logs to monitor, store, and access log files from the EC2 instances. The company's developers use CloudWatch Logs for troubleshooting. A security engineer must implement a solution that prevents the developers from viewing the sensitive data The solution must automatically apply to any new log groups that are created in the account in the future. Which solution will meet these requirements?
Options
- ACreate a CloudWatch Logs account-wide data protection policy. Specify the appropriate data
- BExport the CloudWatch Logs data to an Amazon S3 bucket. Set up automated discovery by using
- CExport the CloudWatch Logs data to an Amazon S3 bucket. Set up automated discovery by using
- DCreate a CloudWatch Logs data protection policy for each log group. Specify the appropriate data
How the community answered
(27 responses)- A81% (22)
- B4% (1)
- C4% (1)
- D11% (3)
Explanation
AWS CloudWatch Logs now supports data protection policies that can be applied at the account level to automatically redact or mask sensitive data in logs. By creating an account-wide policy and specifying the appropriate data identifiers, sensitive data will be protected in all new log The developers can still access the logs, but they will not be able to view sensitive data unless they have the logs:Unmask permission, which should be withheld from them. This approach ensures that sensitive data is protected and meets the requirement for future log groups.
Topics
Community Discussion
No community discussion yet for this question.