SCS-C02 Security Logging and Monitoring Practice Question

A security engineer is implementing centralized logging across multiple AWS accounts. Which TWO actions should the engineer take to ensure logs are securely stored and immutable? (Choose TWO.)

⚠ Common exam trap

Many candidates confuse CloudTrail log file validation (which only detects tampering) with immutability (which prevents tampering), or they mistakenly think MFA Delete provides the same WORM protection as S3 Object Lock.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use AWS KMS with a customer managed key for encryption

Using AWS KMS with a customer managed key (CMK) for encryption ensures that the security engineer has full control over the encryption keys, including key rotation, access policies, and the ability to disable or revoke the key. This prevents unauthorized decryption of logs, even by AWS, and is a critical component of securing log data at rest. Option C is correct because enabling S3 Object Lock on the destination bucket enforces a write-once-read-many (WORM) model, preventing logs from being deleted or overwritten for a specified retention period, which ensures immutability and compliance with regulatory requirements.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Enable S3 Transfer Acceleration on the bucket
Why it's wrong here
Transfer Acceleration speeds uploads over AWS edge locations; it provides no immutability or access restriction, so logs remain deletable. It is the right choice when geographically distant sources need faster ingestion into a bucket, but here the requirement is tamper-proof retention, not throughput.
✓
Use AWS KMS with a customer managed key for encryption
Why this is correct
AWS KMS customer managed keys encrypt logs at rest with granular key policies and audit trails via CloudTrail. This satisfies the secure storage constraint by ensuring only authorised principals can decrypt, and key revocation instantly blocks access.
✓
Enable S3 Object Lock on the destination bucket
Why this is correct
S3 Object Lock enforces write-once-read-many (WORM) protection at the object level, using retention modes and legal holds to prevent deletion or modification for a defined period. This directly satisfies the immutability requirement, ensuring centralised log archives in the destination bucket cannot be tampered with, even by privileged users.
✗
Enable CloudTrail log file validation
Why it's wrong here
Log file validation only detects tampering after the fact by producing digest files; it does not prevent deletion or modification, so immutability is not enforced. It is genuinely useful for verifying CloudTrail log integrity during audits, which is why it appears relevant, but the stem demands storage controls such as S3 Object Lock.
✗
Enable MFA Delete on the bucket
Why it's wrong here
MFA Delete only guards version deletion and bucket versioning changes; it does not block object overwrites or enforce retention, so logs are not immutable. It suits buckets where accidental or malicious version deletion must require a second factor, but the stem needs Object Lock with a retention mode.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Security Logging and Monitoring Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question