A company monitors its account activity using AWS CloudTrail, and is concerned that some log files are being tampered with after the logs have been delivered to the account's Amazon S3 bucket…

Question

Options

• AStream the CloudTrail logs to Amazon CloudWatch Logs to store logs at a secondary location.
• BEnable log file integrity validation and use digest files to verify the hash value of the log file.
• CReplicate the S3 log bucket across regions, and encrypt log files with S3 managed keys.
• DEnable S3 server access logging to track requests made to the log bucket for security audits.

• B
  94% (29)
• C
  3% (1)
• D
  3% (1)

Explanation

Option B is correct because CloudTrail's log file integrity validation feature uses SHA-256 hashing to create digest files every hour - each digest file contains the hash values of all log files delivered during that period, allowing you to cryptographically verify whether any log file was modified, deleted, or forged after delivery to S3.

Why the distractors fail:

• A (CloudWatch Logs streaming) creates a secondary copy but does nothing to verify the integrity of the original files - a tampered log stays tampered even with two copies.
• C (Cross-region replication + SSE-S3) replicates and encrypts data at rest, but replication just copies whatever is in the bucket (including tampered files), and encryption doesn't detect modification.
• D (S3 server access logging) tracks who accessed the bucket, but a sophisticated attacker can tamper with files in ways that may not be obvious from access logs, and access logs themselves don't verify file content hasn't changed.

Memory tip: Think of digest files as a tamper-evident seal - like the security sticker on a medicine bottle. If someone breaks the seal (modifies a log), the hash won't match and you'll know immediately. The keyword pairing to remember for the exam is: CloudTrail + integrity validation = digest files + hash verification.

No community discussion yet for this question.