SCS-C02 · Question #259
A security engineer is setting up an AWS CloudTrail trail for all regions in an AWS account. For added security, the logs are stored using server-side encryption with AWS KMS-managed keys (SSE-KMS)…
The correct answer is B. The KMS key policy does not grant the security engineer's IAM user or rote permissions to. When AWS CloudTrail logs are encrypted using server-side encryption with KMS-managed keys (SSE-KMS), the security engineer's IAM user or role must have explicit permission in the KMS key policy to decrypt the logs. If the IAM user or role does not have the required decryption…
Question
A security engineer is setting up an AWS CloudTrail trail for all regions in an AWS account. For added security, the logs are stored using server-side encryption with AWS KMS-managed keys (SSE-KMS) and have log integrity validation enabled. While testing the solution, the security engineer discovers that the digest files are readable, but the log files are not. What is the MOST likely cause?
Options
- AThe log flies fail integrity validation and automatically are marked as unavailable.
- BThe KMS key policy does not grant the security engineer's IAM user or rote permissions to
- CThe bucket is set up to use server-side encryption with Amazon S3-managed keys (SSE-S3) as
- DAn IAM policy applicable to the security engineer's IAM user or role denies access to the
How the community answered
(31 responses)- A6% (2)
- B77% (24)
- C13% (4)
- D3% (1)
Explanation
When AWS CloudTrail logs are encrypted using server-side encryption with KMS-managed keys (SSE-KMS), the security engineer's IAM user or role must have explicit permission in the KMS key policy to decrypt the logs. If the IAM user or role does not have the required decryption permissions, they will be unable to read the log files, even though the digest files are readable. This is the most likely cause of the issue.
Topics
Community Discussion
No community discussion yet for this question.