SCS-C02 Infrastructure Security Practice Question
A company is using AWS CloudTrail to monitor API activity in their account. They have enabled CloudTrail in all regions and are logging to an S3 bucket. The security team wants to ensure that log files are not tampered with after delivery. They enable CloudTrail log file integrity validation. Which additional step must be taken to verify the integrity of the log files?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the AWS CLI to run the validate-logs command against the log files.
CloudTrail log file integrity validation uses digital signatures (SHA-256 hashing and signing with a private key). To verify integrity, you must use the AWS CLI command 'aws cloudtrail validate-logs' or download the public key and verify manually. Option A (enable S3 versioning) helps protect against accidental deletion or overwriting but does not verify integrity. Option B (use KMS to encrypt logs) protects confidentiality only. Option C (use S3 Object Lock) prevents deletion or modification but does not provide tamper detection or integrity verification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable S3 versioning on the log bucket.
Why it's wrong here
Enabling S3 versioning on the log bucket preserves prior object versions if files are overwritten or accidentally deleted, which aids recovery. However, versioning does not compute or compare cryptographic hashes, so it cannot verify that CloudTrail log files were not modified before being stored. It offers no tamper-evident chain or signature mechanism, therefore it fails to fulfill an integrity verification requirement.
- ✗
Configure the S3 bucket to use server-side encryption with AWS KMS.
Why it's wrong here
Configuring server-side encryption with AWS KMS encrypts log files at rest, protecting confidentiality from unauthorized readers. Encryption alone does not detect or prevent tampering with the file contents: an actor with sufficient permissions could decrypt, alter, and re-encrypt a log file, and CloudTrail would be unaware. Verifying integrity requires hashing and digital signature validation, not encryption.
- ✗
Enable S3 Object Lock on the log bucket.
Why it's wrong here
S3 Object Lock imposes a Write-Once-Read-Many (WORM) model, preventing objects from being overwritten or deleted until their retention period expires. This guards against deletion or malicious writes, but it does not validate the original contents' authenticity or detect alterations made before the object was written to S3. CloudTrail's integrity feature uses a chain of hashes contained in signed digest files to prove that no tampering occurred anywhere in the delivery pipeline.
- ✓
Use the AWS CLI to run the validate-logs command against the log files.
Why this is correct
Run the AWS CLI command `aws cloudtrail validate-logs --trail-arn ... --start-time ... --end-time ...` to validate CloudTrail log file integrity. The command downloads the signed digest files, verifies their digital signatures using CloudTrail's public key, and then compares the SHA-256 hash of each log file against the hash recorded in the digest, detecting any modification, deletion, or insertion. This is the only option that cryptographically verifies log integrity and is purpose-built for exactly this scenario.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.