A Security Engineer Is Setting Up an AWS CloudTrail Trail

question 174

Multiple Choice

A Security Engineer is setting up an AWS CloudTrail trail for all regions in an AWS account. For added security, the logs are stored using server-side encryption with AWS KMS-managed keys (SSE-KMS) and have log integrity validation enabled. While testing the solution, the Security Engineer discovers that the digest files are readable, but the log files are not. What is the MOST likely cause?

• A) The log files fail integrity validation and automatically are marked as unavailable.
• B) The KMS key policy does not grant the Security Engineer's IAM user or role permissions to decrypt with it.
• C) The bucket is set up to use server-side encryption with Amazon S3-managed keys (SSE-S3) as the default and does not allow SSE-KMS-encrypted files.
• D) An IAM policy applicable to the Security Engineer's IAM user or role denies access to the "CloudTrail/" prefix in the Amazon S3 bucket

---

Definitions:

Tumor Suppressor Genes

Genes that help regulate cell growth and division, and can suppress tumor formation when functioning properly.

Pair-Rule Genes

Genes in fruit flies that direct the formation of segmented body patterns during early embryonic development.

Transcription Factors

Proteins that regulate the process of converting DNA into mRNA by binding to specific DNA sequences.

Morphogens

Substances that govern the pattern of tissue development in the process of morphogenesis by forming a concentration gradient that cells respond to.