A company is using AWS CloudTrail and wants to ensure that SysOps administrators can easily verify that the log files have not been deleted or changed. Which action should a SysOps administrator…

The correct answer is B. Enable CloudTrail log file integrity validation when the trail is created or updated. CloudTrail can produce digest files and sign log files to detect tampering. Enabling log file integrity validation ensures that any modification or deletion of delivered log files can be detected by verification against the digests and signatures, providing verifiable evidence…

Submitted by devops_kid· Mar 5, 2026Security and compliance

Question

A company is using AWS CloudTrail and wants to ensure that SysOps administrators can easily verify that the log files have not been deleted or changed. Which action should a SysOps administrator take to meet this requirement?

Options

AGrant administrators access to the AWS Key Management Service (AWS KMS) key used to
BEnable CloudTrail log file integrity validation when the trail is created or updated.
CTurn on Amazon S3 server access logging for the bucket storing the log files.
DConfigure the S3 bucket to replicate the log files to another bucket.

How the community answered

(53 responses)

A
8% (4)
B
77% (41)
C
13% (7)
D
2% (1)

Explanation

CloudTrail can produce digest files and sign log files to detect tampering. Enabling log file integrity validation ensures that any modification or deletion of delivered log files can be detected by verification against the digests and signatures, providing verifiable evidence of tampering or non-tampering for each log file. This is the standard mechanism used to assure SysOps that logs have not been altered after delivery.

Topics

#CloudTrail log integrity#log file validation#audit#tamper detection

Community Discussion

No community discussion yet for this question.

Full SOA-C03 Practice