For legal admissibility, the team must PROVE that archived CloudTrail log files haven't been modified or deleted after delivery. Which feature validates this?
A.S3 versioning
Versioning keeps copies — doesn't prove authenticity.
B.CloudTrail log file integrity validation — digest files with SHA-256 hashes per log
Correct. Hash-chain integrity = tamper evidence.
C.S3 Object Lock alone
Prevents deletion, but doesn't validate delivered file hashes.
D.CloudTrail Insights
Insights detects unusual API activity — not integrity.
Why this answer
Integrity validation makes each log file's hash available via digest files — you can cryptographically verify no modification/deletion occurred, which is precisely what audits/court-admissibility require. Object Lock prevents future modification but can't prove past integrity of delivered files.
Correct answer: B · Last reviewed 2026-11-03
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Logging & Audit practice session.
Practice Logging & Audit