AWS Certified Security – Specialty (SCS-C02) — Question 256

A security engineer is setting up an AWS CloudTrail trail for all regions in an AWS account. For added security, the logs are stored using server-side encryption with AWS KMS-managed keys (SSE-KMS) and have log integrity validation enabled.

While testing the solution, the security engineer discovers that the digest files are readable, but the log files are not. What is the MOST likely cause?

Answer options

• A. The log files fail integrity validation and automatically are marked as unavailable.
• B. The KMS key policy does not grant the security engineer’s IAM user or role permissions to decrypt with it.
• C. The bucket is set up to use server-side encryption with Amazon S3-managed keys (SSE-S3) as the default and does not allow SSE-KMS-encrypted files.
• D. An IAM policy applicable to the security engineer’s IAM user or role denies access to the “CloudTrail/” prefix in the Amazon S3 bucket.

Correct answer: B

Explanation

The correct answer is B because if the KMS key policy does not grant the necessary permissions to the security engineer’s IAM user or role, they will be unable to decrypt the log files, resulting in unreadability. Option A is incorrect as it relates to integrity validation, which does not apply here since the digest files are readable. Options C and D are also incorrect because they do not pertain to the KMS key permissions which are central to the issue at hand.