CloudTrail Quiz
You have enabled CloudTrail logs for your company’s AWS account. In addition, the IT Security department has mentioned that the logs need to be encrypted. How can this be achieved?
A. Enable SSL certificates for the CloudTrail logs.
B. There is no need to do anything since the logs will already be encrypted.
C. Enable Server-Side Encryption for the trail.
D. Enable Server-Side Encryption for the destination S3 bucket.
B. There is no need to do anything since the logs will already be encrypted.
AWS Documentation mentions the following:
By default, CloudTrail event log files are encrypted using Amazon S3 server-side encryption (SSE). You can also choose to encrypt your log files with an AWS Key Management Service (AWS KMS) key. You can store your log files in your bucket for as long as you want. You can also define Amazon S3 lifecycle rules to archive or delete log files automatically. If you want notifications about log file delivery and validation, you can set up Amazon SNS notifications.
For more information on how CloudTrail works, please visit the following URL:
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/how-cloudtrail-works.html
