SCS-C02 Data Protection Practice Question
A company uses AWS CloudTrail to log API activity. The security team wants to ensure that log files are encrypted at rest and that any tampering with logs is detectable. Which combination of services should be used?
⚠ Common exam trap
SCS-C02 often tests the difference between encryption at rest and tamper detection — candidates pick SSE-S3 or access logs thinking they cover integrity, when only CloudTrail's digest-based validation actually proves logs were not modified.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable CloudTrail log file SSE-KMS encryption and enable CloudTrail log file integrity validation.
CloudTrail log file integrity validation produces digest files signed with SHA-256 and RSA that let you prove logs were not altered or deleted after delivery, while SSE-KMS encryption protects the log objects at rest with a customer-managed or AWS-managed KMS key. Together they satisfy both the confidentiality and tamper-detection requirements. This is the AWS-documented combination for secure, verifiable CloudTrail log storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable CloudTrail and configure S3 bucket to use default encryption and enable S3 server access logs.
Why it's wrong here
Enabling CloudTrail and S3 default encryption protects log files at rest from casual reading, but S3 server access logs only record requests made to the bucket. They do not create a cryptographic hash chain or signed digests, so they cannot prove whether CloudTrail log files were modified, deleted, or replayed. Integrity validation is the required tamper-evident mechanism.
- ✓
Enable CloudTrail log file SSE-KMS encryption and enable CloudTrail log file integrity validation.
Why this is correct
SSE-KMS encrypts CloudTrail log files with a customer-managed KMS key, giving you explicit control over decryption permissions and key rotation. CloudTrail log file integrity validation then publishes signed digest files containing SHA-256 hashes of each log file, allowing you to cryptographically verify that files were not altered or deleted after delivery. The two features together satisfy confidentiality and tamper detection.
- ✗
Use AWS CloudHSM to generate keys and encrypt CloudTrail logs at the application layer.
Why it's wrong here
AWS CloudHSM is a single-tenant hardware security module, but CloudTrail does not automatically use CloudHSM-generated keys to encrypt log objects; you would still configure SSE-KMS (possibly via a CloudHSM-backed custom key store). Storing and encrypting logs 'at the application layer' would require building a separate ingestion pipeline, and it is not a native CloudTrail setting. Since this approach neither uses CloudTrail's integrity validation nor its KMS encryption integration, it does not meet the requirement.
- ✗
Enable CloudTrail log file encryption using SSE-S3 and store logs in CloudWatch Logs.
Why it's wrong here
SSE-S3 uses S3-managed keys for server-side encryption and is available for CloudTrail, but its key management is opaque and it does not generate a hash-based digest trail. Placing logs in CloudWatch Logs gives you alerting and metrics, not an integrity-validation mechanism; CloudWatch cannot detect whether an original CloudTrail log file was modified. The correct tamper-evidence control is CloudTrail's own digest signing.
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.