SOA-C02 Monitoring, Logging, and Remediation Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable CloudTrail log file integrity validation.

  Why this is correct

  CloudTrail log file integrity validation provides cryptographic assurance that your log files have not been tampered with. It uses SHA-256 hashing to generate a hash for each log file, and then digitally signs it with a private key. You can validate these signatures using the public key published by AWS, which lets you detect any modification, deletion, or unauthorized change to the logs, even if someone attempts to alter the digest files themselves.

• ✗

  Enable S3 server-side encryption on the CloudTrail S3 bucket.

  Why it's wrong here

  Enabling server-side encryption (SSE) on the CloudTrail S3 bucket only encrypts the data at rest, protecting it from unauthorized access to the underlying storage. Encryption does not provide any integrity verification or tamper-evidence, because a user with valid decrypting permissions could still read, alter, and re-encrypt log files without detection. Thus, while SSE is a good security practice, it does not satisfy the requirement to prove that logs have not been modified.

• ✗

  Stream CloudTrail logs to Amazon CloudWatch Logs.

  Why it's wrong here

  Streaming CloudTrail events to Amazon CloudWatch Logs enables real-time monitoring, metric filters, and alarms on API activity, but it does not generate any hash or digital signature for the original log files. Without cryptographic integrity checks, an attacker who modifies the CloudTrail logs—or the stream itself—can go undetected because no baseline or signature exists to compare against. This approach is reactive and provides visibility, not forensic proof of log authenticity.

• ✗

  Enable S3 Multi-Factor Authentication (MFA) Delete on the CloudTrail S3 bucket.

  Why it's wrong here

  Enabling S3 Multi-Factor Authentication (MFA) Delete on the CloudTrail bucket requires additional authentication to delete object versions, which helps prevent accidental or unauthorized deletion. However, it does not protect against modifications to existing log objects, nor does it provide any way to verify that files have not been altered after being written. MFA Delete is a deletion control, not an integrity control, so it fails to meet the requirement of proving log file integrity.

Go deeper

Related to this question