SOA-C02 · Question #27
A company asks a SysOps administrator to ensure that AWS CloudTrail files are not tampered with after they are created. Currently, the company uses AWS Identity and Access Management (IAM) to…
The correct answer is D. Enable the CloudTrail file integrity feature on the trail. When you enable log file integrity validation, CloudTrail creates a hash for every log file that it delivers. Every hour, CloudTrail also creates and delivers a file that references the log files for the last hour and contains a hash of each. This file is called a digest file…
Question
A company asks a SysOps administrator to ensure that AWS CloudTrail files are not tampered with after they are created. Currently, the company uses AWS Identity and Access Management (IAM) to restrict access to specific trails. The company's security team needs the ab lity to trace the integrity of each file. What is the MOST operationally efficient solution that meets these requ rements?
Options
- ACreate an Amazon EventBridge (Amazon CloudWatch Events) rule that invokes an AWS Lambda
- BCreate an AWS Lambda function that is invoked each time a new file is delivered to the
- CEnable the CloudTrail file integrity feature on an Amazon S3 bucket.
- DEnable the CloudTrail file integrity feature on the trail.
How the community answered
(20 responses)- A5% (1)
- B10% (2)
- C5% (1)
- D80% (16)
Explanation
When you enable log file integrity validation, CloudTrail creates a hash for every log file that it delivers. Every hour, CloudTrail also creates and delivers a file that references the log files for the last hour and contains a hash of each. This file is called a digest file. Validated log files are invaluable in security and forensic investigations https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html
Topics
Community Discussion
No community discussion yet for this question.