Examkin

Soru

Zorluk: KolayAWS CloudTrail Configuration and Management

An organization requires a SysOps Administrator to verify that the AWS CloudTrail log files delivered to an Amazon S3 bucket have not been modified, deleted, or tampered with after delivery. Which CloudTrail feature should be configured to satisfy this requirement?

  1. A
    Configure AWS KMS encryption using a customer managed key.
  2. B
    Enable Multi-Factor Authentication (MFA) Delete on the destination S3 bucket.
  3. Enable log file integrity validation on the trail.Cevap
  4. D
    Create an Amazon EventBridge rule that triggers an AWS Lambda function when log files are delivered.

Cevap

Enable log file integrity validation on the trail.
Enabling log file integrity validation causes CloudTrail to deliver cryptographically signed digest files to the S3 bucket. These digest files can be used with the AWS CLI to verify that the log files have not been modified, deleted, or tampered with since they were delivered by CloudTrail.

Adım Adım Çözüm

1
Identify the core security requirement.
The requirement is to detect if CloudTrail log files have been modified, deleted, or tampered with after delivery.
This establishes that we need a mechanism to verify log integrity.
2
Evaluate the native features of AWS CloudTrail that support log integrity.
AWS CloudTrail provides a built-in feature called log file integrity validation, which uses SHA-256 for hashing and SHA-256 with RSA for digital signatures.
This feature generates digest files that contain a hash of the log files, allowing verification of whether log files were modified or deleted.

Anahtar Kavram

CloudTrail Log File Integrity Validation
Bu soruyu puanla

Konular

AWS CloudTrail Configuration and Management

Bu konudan daha fazla soru