Examkin

Question

Difficulty: MediumSecurity Monitoring, Logging, and Compliance Auditing

During a security review, an organization requires a SysOps administrator to confirm that all AWS CloudTrail logs stored in a centralized Amazon S3 bucket remain untampered. Although log file integrity validation is active, the administrator must run a manual check to verify the authenticity of the logs delivered over the past week. Which action should the administrator take to perform this verification?

  1. Execute the aws cloudtrail validate-logs command via the AWS CLI to cryptographically verify the signatures of the log files against the digest files.Answer
  2. B
    Query the S3 bucket access logs using Amazon Athena to identify any PUT or DELETE operations that occurred on the log files.
  3. C
    Configure an Amazon EventBridge rule to trace API activity and trigger a Systems Manager Automation runbook to compare the S3 object metadata.
  4. D
    Change the CloudTrail log group settings in Amazon CloudWatch Logs to verify the cryptographic checksum of the streamed log events.

Answer

Execute the aws cloudtrail validate-logs command via the AWS CLI to cryptographically verify the signatures of the log files against the digest files.
The correct action is to run the validate-logs command from the AWS CLI. When log file integrity validation is enabled, CloudTrail creates digest files every hour containing the hash of each log file and a digital signature. The command automatically downloads these digests and the corresponding log files, recalculates the hashes, and validates the digital signatures to ensure that the logs have not been tampered with or deleted since creation.

Step-by-Step Solution

1
Identify the requirement to manually verify the integrity of CloudTrail log files stored in an S3 bucket.
The trail has log file integrity validation enabled, which generates digest files containing hashes of the log files.
Log file integrity validation creates signature digest files that are signed using private keys, allowing authentication of the logs.
2
Determine the appropriate AWS tool or command to perform the verification.
The AWS CLI provides the validate-logs command.
This command downloads the digest files and log files, verifies the signatures, and checks the SHA-256 hashes to detect any tampering or deletion.

Key Concept

CloudTrail Log File Integrity Validation
Rate this question

Topics

Security Monitoring, Logging, and Compliance Auditing

More questions from this topic