SCS-C02 Security Logging and Monitoring Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS KMS server-side encryption on the S3 bucket

  Why it's wrong here

  AWS KMS server-side encryption protects the confidentiality of CloudTrail log files at rest by encrypting them with an AWS KMS customer managed key, but it does not create any cryptographic digest or hash of the log contents. An attacker with S3 write access can still overwrite or modify log files, and the encrypted bytes will simply be re-encrypted with the same key without any detectable integrity failure. The integrity validation feature, not encryption, is what provides verifiable tamper-evidence.

• ✓

  CloudTrail log file integrity validation

  Why this is correct

  CloudTrail log file integrity validation creates a SHA-256 hash of each log file, chains that hash to the previous file's hash, and signs the resulting digest with a private key. The public key is distributed by AWS, so you can independently verify both the signature and the hash chain to detect any modification, deletion, or reordering of log files. It is the only option listed that provides cryptographic proof of log integrity.

• ✗

  S3 bucket versioning

  Why it's wrong here

  S3 bucket versioning preserves every version of an object, so if a CloudTrail log file is overwritten or deleted, you can restore the prior version from the bucket. However, versioning does not generate a verifiable hash of the log contents, and it cannot tell you whether the current version was tampered with versus the original; an attacker who modifies a log file simply creates a new version that replaces the last one. To prove non-tampering, you need CloudTrail's digest-based integrity validation, not versioning.

• ✗

  S3 Object Lock with governance mode

  Why it's wrong here

  S3 Object Lock with governance mode places a retention setting that prevents most users from overwriting or deleting an object version unless they are explicitly granted the s3:BypassGovernanceRetention permission. While this raises the bar for an attacker, it does not detect or cryptographically verify whether a log file's content has been altered, and the governance mode is designed to be bypassable by authorized administrators. Like versioning, it is an availability/retention control, not an integrity control.

Go deeper

Related to this question