CCSP Cloud Security Operations Practice Question
A security team is configuring AWS CloudTrail to enable detection of unauthorized API calls. They want to ensure that log files cannot be tampered with after delivery. Which CloudTrail feature should they enable?
⚠ Common exam trap
Candidates often mistake CloudTrail Insights (which detects unusual patterns) for a tamper-detection feature, but only Log File Validation provides cryptographic integrity verification of log files.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CloudTrail Log File Validation
CloudTrail Log File Validation (option B) uses a SHA-256 hash chain to create a digital signature for each log file, enabling integrity verification. When enabled, CloudTrail delivers digest files that contain hashes of log files, allowing you to confirm that log files were not modified, deleted, or tampered with after delivery. This directly addresses the requirement to detect unauthorized API calls by ensuring the logs themselves are trustworthy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CloudTrail Insights
Why it's wrong here
CloudTrail Insights detects unusual API activity but does not provide integrity validation.
- ✓
CloudTrail Log File Validation
Why this is correct
This feature creates a signed digest file for each log file, enabling integrity verification.
- ✗
CloudTrail Multi-Region Trail
Why it's wrong here
Multi-region trails aggregate logs across regions but do not ensure integrity.
- ✗
CloudTrail Event History
Why it's wrong here
Event History is a view of recent events, not an integrity mechanism.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.