SCS-C02 Security Logging and Monitoring Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable CloudTrail log file validation

  Why this is correct

  CloudTrail log file validation creates a SHA-256 hash of each log file and stores it in a digest file in the same S3 bucket. When enabled, you can use the AWS CLI or API to validate that log files were not modified or deleted after delivery. It uses a private key to sign the digest files, providing cryptographic assurance that the logs themselves are authentic and intact. This directly detects any tampering with log integrity, unlike the other options.

• ✗

  Enable MFA Delete on the S3 bucket

  Why it's wrong here

  MFA Delete requires a multi-factor authentication token to permanently delete an object version or suspend versioning on the bucket. While this helps protect against accidental or unauthorized deletion of CloudTrail logs, it does not verify whether the log file contents have been modified after being written. MFA Delete is a deletion control, not an integrity control, so it cannot detect tampering or prove that logs retain their original state.

• ✗

  Enable S3 Versioning on the bucket

  Why it's wrong here

  S3 Versioning preserves every version of an object, allowing you to restore a previous version if a log is overwritten or deleted. It provides availability and recovery capabilities but does not compute any hashes or signatures to validate that a log file's content has not been altered. An attacker with permissions could modify a log file and versioning would simply create a new version without flagging the change. Thus, versioning alone cannot ensure the authenticity or integrity of CloudTrail logs.

• ✗

  Enable S3 bucket default encryption

  Why it's wrong here

  Default encryption for the S3 bucket ensures that CloudTrail log files are encrypted at rest using SSE-S3 or SSE-KMS. Encryption protects the confidentiality of the log data by preventing unauthorized parties from reading it, but it does not detect whether the ciphertext or plaintext has been tampered with. Integrity validation requires cryptographic hashing or digital signatures, not encryption. Therefore, default encryption does not help verify that the logs have not been modified.

Go deeper

Related to this question