SCS-C02 · Question #309
A company's AWS CloudTrail logs are all centrally stored in an Amazon S3 bucket. The security team controls the company's AWS account. The security team must prevent unauthorized access and…
The correct answer is A. Configure server-side encryption with AWS KMS managed encryption keys (SSE-KMS) D. Implement least privilege access to the S3 bucket by configuring a bucket policy. E. Configure CloudTrail log file integrity validation. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html
Question
A company's AWS CloudTrail logs are all centrally stored in an Amazon S3 bucket. The security team controls the company's AWS account. The security team must prevent unauthorized access and tampering of the CloudTrail logs. Which combination of steps should the security team take? (Choose three.)
Options
- AConfigure server-side encryption with AWS KMS managed encryption keys (SSE-KMS)
- BCompress log file with secure gzip.
- CCreate an Amazon EventBridge (Amazon CloudWatch Events) rule to notify the security team of
- DImplement least privilege access to the S3 bucket by configuring a bucket policy.
- EConfigure CloudTrail log file integrity validation.
- FConfigure Access Analyzer for S3.
How the community answered
(46 responses)- A72% (33)
- B4% (2)
- C9% (4)
- F15% (7)
Explanation
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html
Topics
Community Discussion
No community discussion yet for this question.