SCS-C02 Security Logging and Monitoring Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Query the log files using Amazon CloudWatch Logs Insights.

  Why it's wrong here

  CloudWatch Logs Insights is a query engine that analyzes structured log data ingested into CloudWatch Logs; it cannot access the CloudTrail digest files stored in S3, nor does it compute or compare cryptographic hashes across log files. Because integrity validation relies on verifying a digital signature and content hash from a digest file, using a log query tool is irrelevant to that purpose and cannot detect tampering. Even if CloudTrail is configured to stream events to CloudWatch Logs, Insights only searches event text—it has no mechanism to validate the chain of custody or authenticity of the S3 objects.

• ✗

  Enable S3 server-side encryption with AWS KMS (SSE-KMS) on the CloudTrail bucket.

  Why it's wrong here

  Enabling SSE-KMS encrypts objects at rest, protecting the confidentiality of the log data from unauthorized read access, but it does not provide any integrity checks. Integrity verification requires a trustworthy hash of the object's content (like SHA-256) plus a digital signature to prove the hash hasn't been altered; encryption alone does not prevent a privileged party from rewriting log objects before or after encryption. Furthermore, SSE-KMS manages keys but does not offer a per-object tamper-evident digest, so this control addresses a different security objective entirely.

• ✗

  Enable S3 Object Lock on the bucket to prevent modifications.

  Why it's wrong here

  S3 Object Lock enforces retention policies to prevent object deletion or modification, typically for governance or compliance requirements, but it cannot prove an object was unmodified at the time of locking. Any integrity verification must compare the current object content against a trusted baseline—for CloudTrail this baseline is the SHA-256 hash embedded in a separate digest file and signed by AWS's public key. Object Lock only prevents writes after the lock is applied; it does not validate whether the log file matches the expected hash or whether the file was tampered with before the lock became active.

• ✓

  Use the AWS CLI `validate-logs` command with the digest file from the S3 bucket.

  Why this is correct

  The `aws cloudtrail validate-logs` command implements CloudTrail's integrity validation by reading the digest files delivered to the S3 bucket. Each digest file contains the SHA-256 hash of the log files and a digital signature generated with AWS's private key; the CLI retrieves the corresponding public key from AWS, verifies the signature, and then recomputes the hash of each log file to compare against the digest. This process cryptographically confirms that log files were not altered or removed during delivery, providing a tamper-evident chain from the moment CloudTrail wrote the file.

Go deeper

Related to this question