A company is using CloudTrail to log all AWS API activity for all regions in all of its accounts. The CISO has asked that additional steps be taken to protect the integrity of the log files.
What combination of steps will protect the log files from intentional or unintentional alteration?
Choose 2 answers from the options given below

Answer options:

A.Create an S3 bucket in a dedicated log account and grant the other accounts write only access. Deliver all log files from every account to this S3 bucket.
B.Write a Lambda function that queries the Trusted Advisor Cloud Trail checks. Run the function every 10 minutes.
C.Enable Cloud Trail log file integrity validation
D.Use Systems Manager Configuration Compliance to continually monitor the access policies of S3 buckets containing Cloud Trail logs.
E.Create a Security Group that blocks all traffic except calls from the CloudTrail service. Associate the security group with all the Cloud Trail destination S3 buckets.

Answers: A and C
Option A is CORRECT because AWS CloudTrail is used to log all AWS API activity for all regions in all of its accounts.
Option B is incorrect because querying the Trusted Advisor Cloud trail is not possible.
Option C is CORRECT because to determine whether a Log file was modified, deleted, or unchanged after CloudTrail delivered it, you can use CloudTraii log file integrity validation. This feature is built using industry-standard algorithms: SHA-256 for hashing and SHA-256 with RSA for digital signing. This makes it computationally infeasible to modify, delete or forge CloudTrail log files without detection. 
Option D is incorrect because AWS System Manager cannot be used as a service to monitor access policies.
Option E is incorrect because Security Groups are used for EC2 Instances and not S3 buckets.
For more information on AWS CloudTrail log file validation, refer the URL below:
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html
For more information on delivering CloudTrail logs from multiple accounts, please visit the below URL
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-receive-logs-from-multiple-accounts.html