CLF-C02 Security and Compliance Practice Question
A company uses AWS CloudTrail to log all API calls in their AWS account for compliance and security auditing. Their compliance officer needs to prove to an external auditor that the CloudTrail log files have not been altered or deleted after they were created. The company must use the most cost-effective and built-in AWS feature to detect any tampering with the log files. What should the company enable?
⚠ Common exam trap
Many exam-takers confuse encryption (which protects confidentiality) with integrity validation (which proves data has not been altered), leading them to choose SSE-KMS or MFA delete instead of the built-in, cost-free integrity validation feature.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable CloudTrail log file integrity validation
CloudTrail log file integrity validation uses a hash chain (SHA-256) to create a digest file that is signed with a private key, allowing you to verify that log files have not been modified, deleted, or tampered with after delivery. This is a built-in, no-cost feature that directly meets the compliance officer's requirement to prove log integrity to an external auditor without additional services or costs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable CloudTrail log file integrity validation
Why this is correct
Correct. Log file integrity validation uses hash-based digital signatures to verify that CloudTrail log files have not been modified or deleted after they were delivered to the S3 bucket. It is a built-in, cost-effective feature designed for this purpose.
- ✗
Enable server-side encryption for the CloudTrail log file S3 bucket using SSE-KMS
Why it's wrong here
Incorrect. Server-side encryption protects the confidentiality of the log files at rest, but it does not provide any mechanism to detect tampering or verify that the files have not been altered. Encryption does not ensure integrity.
When this WOULD be correct
Enable SSE-KMS when the compliance requirement is to control encryption keys and meet regulatory standards for data encryption at rest, such as using customer-managed keys for CloudTrail logs.
- ✗
Configure CloudTrail to send logs to CloudWatch Logs and set a metric filter for changes
Why it's wrong here
Incorrect. Sending logs to CloudWatch Logs allows real-time monitoring and alerting based on log content, but it does not provide a cryptographic verification that the original log files stored in S3 have not been tampered with. The CloudWatch Logs copy could also be altered.
When this WOULD be correct
A company needs real-time monitoring and alerting on specific CloudTrail log events (e.g., unauthorized API calls). They should configure CloudTrail to send logs to CloudWatch Logs and set a metric filter to trigger alarms for those events.
- ✗
Enable multi-factor authentication (MFA) delete on the S3 bucket
Why it's wrong here
Incorrect. MFA delete adds an additional authentication requirement to delete objects, which helps prevent unauthorized deletion. However, it does not detect or prevent modification of the log file content after it is written, nor does it provide any integrity verification.
When this WOULD be correct
A company needs to prevent unauthorized deletion of critical S3 objects, such as CloudTrail logs, even if the AWS credentials are compromised. Enabling MFA delete on the S3 bucket would require multi-factor authentication for delete operations, adding an extra layer of security.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable CloudTrail log file integrity validationCorrect answer▾
Why this is correct
Correct. Log file integrity validation uses hash-based digital signatures to verify that CloudTrail log files have not been modified or deleted after they were delivered to the S3 bucket. It is a built-in, cost-effective feature designed for this purpose.
✗Enable server-side encryption for the CloudTrail log file S3 bucket using SSE-KMSWrong answer — click to see why▾
Why this is wrong here
Server-side encryption (SSE-KMS) protects data at rest but does not provide a mechanism to detect tampering or deletion of log files after they are created; it only ensures encryption.
★ When this WOULD be the correct answer
Enable SSE-KMS when the compliance requirement is to control encryption keys and meet regulatory standards for data encryption at rest, such as using customer-managed keys for CloudTrail logs.
Why candidates choose this
Candidates may confuse encryption with integrity validation, thinking that encryption prevents tampering, but encryption only protects confidentiality, not integrity.
✗Configure CloudTrail to send logs to CloudWatch Logs and set a metric filter for changesWrong answer — click to see why▾
Why this is wrong here
CloudTrail log file integrity validation is the built-in, cost-effective feature for detecting tampering. Sending logs to CloudWatch Logs with a metric filter can monitor for changes but does not provide cryptographic proof of log file integrity.
★ When this WOULD be the correct answer
A company needs real-time monitoring and alerting on specific CloudTrail log events (e.g., unauthorized API calls). They should configure CloudTrail to send logs to CloudWatch Logs and set a metric filter to trigger alarms for those events.
Why candidates choose this
Candidates may think that monitoring log changes via CloudWatch Logs is equivalent to integrity validation, but it lacks the cryptographic hash verification that proves logs have not been altered.
✗Enable multi-factor authentication (MFA) delete on the S3 bucketWrong answer — click to see why▾
Why this is wrong here
MFA delete protects against accidental or unauthorized deletion of S3 objects, but it does not provide a mechanism to detect tampering or prove that log files have not been altered after creation. The question specifically requires a feature to detect tampering, not prevent deletion.
★ When this WOULD be the correct answer
A company needs to prevent unauthorized deletion of critical S3 objects, such as CloudTrail logs, even if the AWS credentials are compromised. Enabling MFA delete on the S3 bucket would require multi-factor authentication for delete operations, adding an extra layer of security.
Why candidates choose this
Candidates may confuse prevention of deletion with detection of tampering, or think that MFA delete provides integrity validation because it adds security controls to the S3 bucket.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.