AWS Certified Security – Specialty — Question 95

A Security Engineer is setting up an AWS CloudTrail trail for all regions in an AWS account. For added security, the logs are stored using server-side encryption with AWS KMS-managed keys (SSE-KMS) and have log integrity validation enabled.
While testing the solution, the Security Engineer discovers that the digest files are readable, but the log files are not. What is the MOST likely cause?

Answer options

• A. The log files fail integrity validation and automatically are marked as unavailable.
• B. The KMS key policy does not grant the Security Engineer's IAM user or role permissions to decrypt with it.
• C. The bucket is set up to use server-side encryption with Amazon S3-managed keys (SSE-S3) as the default and does not allow SSE-KMS-encrypted files.
• D. An IAM policy applicable to the Security Engineer's IAM user or role denies access to the "CloudTrail/" prefix in the Amazon S3 bucket.

Correct answer: B

Explanation

The correct answer is B because if the KMS key policy does not allow the Security Engineer's IAM user or role to decrypt the logs, they will be unable to access the log files despite the digest files being readable. Option A is incorrect because if the log files failed integrity validation, they would not be accessible at all. Option C is wrong as the scenario specifies the use of SSE-KMS, not SSE-S3, and Option D is irrelevant since the issue pertains to decryption permissions, not access restrictions to the prefix.