Long-term evidence of sensitive data access must be retained.
Verify that log files were not deleted or modified after delivery.
Which protection approach is most appropriate?
Enable CloudTrail log-file validation and store logs in a separately protected S3 location with retention controls.
Detailed explanation
A single local copy is easy to lose or alter and is weak audit evidence.
A single local copy is easy to lose or alter and is weak audit evidence.
Digest validation detects modification, while independent storage controls reduce deletion risk.
Digest validation detects modification, while independent storage controls reduce deletion risk.
Immediate expiration violates retention and prevents integrity checks.
Immediate expiration violates retention and prevents integrity checks.
A visual display does not provide cryptographic integrity verification.
A visual display does not provide cryptographic integrity verification.
Check official documentation
Compare the following points with the official documentation.
AWS CloudTrail log file integrity validation、digest files、S3 Object Lockの公式説明を確認する。
What to confirm
表示や保存だけでなく、完全性検証と削除防止が必要な理由を説明できる。
Key points
- Log file validation
- Digest
- Object Lock
- Audit trail
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Separation of duties
The account that produces logs should not be able to silently delete the protected copy.
Retention policy
Legal retention, cost, and approved expiration should be documented together.