AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 219

Question

A security engineer is setting up an AWS CloudTrail trail for all regions in an AWS account. For added security, the logs are stored using server-side encryption with AWS KMS-managed keys (SSE-KMS) and have log integrity validation enabled. While testing the solution, the security engineer discovers that the digest files are readable, but the log files are not. What is the MOST likely cause?

Accepted Answer

Correct answer: B. The correct answer is B. Option B: The KMS key policy does not grant the security engineer’s IAM user or role permissions to decrypt with it. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

AWS Certified Security - Specialty SCS-C02 — Question 219