CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS Certified Security - Specialty Exam Question Walkthrough
Learn how to tackle a specific AWS Certified Security - Specialty exam question about CloudTrail log retention.
Your organization is using AWS CloudTrail to log API calls in your AWS account. However, the security team notices that logs are not being retained as expected. What is the best practice to ensure that CloudTrail logs are retained for compliance purposes?
The question
- A. Store CloudTrail logs in Amazon S3 with versioning enabled.
- B. Enable CloudTrail to send logs to CloudWatch Logs.
- C. Use AWS Config to monitor CloudTrail log retention.
- D. Regularly download logs and store them on-premises.
Think before you scroll
Consider what options provide actual retention guarantees for logs. Compliance often requires not just monitoring but also secure storage and accessibility for audits.
The answer
The correct option is A. Store CloudTrail logs in Amazon S3 with versioning enabled. This method ensures that logs are retained securely, allowing for compliance audits over time.
Why the other options lose
B. Enable CloudTrail to send logs to CloudWatch Logs. While this option is useful for real-time monitoring, it does not ensure long-term log retention. CloudWatch Logs can have retention policies, but they do not offer the same level of security and accessibility as S3 with versioning.
C. Use AWS Config to monitor CloudTrail log retention. This option focuses on monitoring rather than retention. AWS Config can help track compliance, but it does not store logs, leaving the actual retention unaddressed.
D. Regularly download logs and store them on-premises. This approach is risky. It depends on manual processes, which can lead to human error and potential data loss. Compliance requires reliable, automated storage solutions.
The concept behind it
For compliance, storing logs securely is critical. AWS S3 with versioning not only preserves logs against accidental deletion but also provides durability and accessibility. This principle applies across various logging services, ensuring logs are retained for audits.
Exam trap to remember
Always prioritize secure, automated storage for compliance logs over manual processes or real-time monitoring solutions.