Exam AWS Certified SysOps Administrator - Associate topic 1 question 62 discussion

D - "When you enable log file integrity validation, CloudTrail creates a hash for every log file that it delivers. Every hour, CloudTrail also creates and delivers a file that references the log files for the last hour and contains a hash of each. This file is called a digest file. Validated log files are invaluable in security and forensic investigations" https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html

Correct Answer: D CloudTrail File Integrity: AWS CloudTrail offers a built-in file integrity validation feature. When this feature is enabled, CloudTrail automatically creates digest files that provide a way to verify that log files have not been tampered with. The digest files contain hashes that allow the security team to trace the integrity of each file, ensuring data has not been altered. Operational Efficiency: This solution is the most operationally efficient, as it leverages CloudTrail’s native functionality without requiring additional resources like Lambda functions or DynamoDB tables. Other Options: Option A and Option B: Both require custom implementations using Lambda to calculate file hashes, which increases complexity and operational overhead. Option C: The CloudTrail file integrity feature is enabled directly on the trail itself, not just on the S3 bucket, so this option does not fully meet the requirements.

D is the Answer

AWS CloudTrail provides a feature that allows you to validate the integrity of the CloudTrail log files stored in your S3 bucket. When you enable log file integrity validation, CloudTrail creates a digest file for every log that is delivered to your account. This file contains the hash values of every log file in the delivery and can be used to confirm that the logs have not been tampered with.

Answer is D

Validating CloudTrail log file integrity is important to ensure that the logs have not been tampered with and to verify their authenticity

D is correct answer

D it is

DDDDDDDD

only D

I vote D as well

D. CloudTrail log file integrity validation

integrity is not an s3 feature, it's a cloudtrail feature. vote for D

I vote for D

D is the answer

choose D

Answer D no S3 bucket enabling. "To enable log file integrity validation, you can use the AWS Management Console, the AWS CLI, or CloudTrail API. For more information, see Enabling log file integrity validation for CloudTrail." "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html"