A company needs to build a code-signing solution using an AWS KMS asymmetric key and must store immutable evidence of key creation and usage for compliance and audit purposes. Which solution meets…

Question

Options

• ACreate an Amazon S3 bucket with S3 Object Lock enabled. Create an AWS CloudTrail trail with
• BLog application events to Amazon CloudWatch Logs and export them.
• CCapture KMS API calls using EventBridge and store them in DynamoDB.
• DTrack KMS usage with CloudWatch metrics and dashboards.

• A
  80% (16)
• B
  5% (1)
• C
  5% (1)
• D
  10% (2)

Explanation

Explanation

Option A is correct because AWS CloudTrail natively captures all KMS API calls (including key creation and cryptographic operations) as immutable, tamper-evident log records, and storing those logs in an S3 bucket with S3 Object Lock ensures the evidence cannot be deleted or modified - satisfying both compliance and audit immutability requirements for code-signing workflows.

Why the distractors are wrong:

• Option B (CloudWatch Logs export) does not guarantee immutability - logs can be altered or deleted, and CloudWatch is designed for operational monitoring, not compliance-grade audit trails.
• Option C (EventBridge → DynamoDB) is a custom, non-native approach; DynamoDB does not provide built-in immutability (records can be overwritten or deleted), making it unsuitable for strict compliance evidence.
• Option D (CloudWatch metrics/dashboards) only provides aggregated performance data - it does not capture individual API call details or provide any immutability guarantees required for audit evidence.

Memory Tip

Think "CloudTrail = WHO did WHAT, S3 Object Lock = PROVE IT FOREVER." Whenever a question mentions immutable audit evidence for AWS API activity, the winning combination is almost always CloudTrail + S3 Object Lock (WORM storage).

No community discussion yet for this question.