A company uses CloudTrail to log all AWS API activity for all regions in all of its accounts. The CISO has asked that additional steps be taken to protect the integrity of the log files.
What combination of steps will protect the log files from intentional or unintentional alteration? Choose 2 answers from the options given below.
 

Answer options:

A.Create an S3 bucket in a dedicated log account and grant the other accounts write-only access. Deliver all log files from every account to this S3 bucket.
B.Write a Lambda function that queries the Trusted Advisor CloudTrail checks. Run the function every 10 minutes.
C.Enable CloudTrail log file integrity validation.
D.Use Systems Manager Configuration Compliance to continually monitor the access policies of S3 buckets containing CloudTrail logs.
E.Create a Security Group that blocks all traffic except calls from the CloudTrail service. Associate the security group with all the CloudTrail destination S3 buckets.

Answer: A and C
Option A is CORRECT because this would be a best practice to have all accounts write and store their CloudTrail log files under a single S3 bucket.
Option B is incorrect because querying the Trusted Advisor CloudTrail is not possible.
Option C is CORRECT because to determine whether a log file was modified, deleted, or unchanged after CloudTrail delivered it, you can use CloudTrail log file integrity validation. This feature is built using industry-standard algorithms such as SHA-256 for hashing and SHA-256 with RSA for digital signing. This makes it computationally infeasible to modify, delete or forge CloudTrail log files without detection.
Option D is incorrect because the Systems Manager cannot be used as a service to monitor access policies.
Option E is incorrect because Security Groups are used for EC2 Instances and not S3 buckets.
For more information on CloudTrail log file validation, kindly refer to the below URL:
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html
For more information on delivering CloudTrail logs from multiple accounts, kindly refer to the below URL:
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-receive-logs-from-multiple-accounts.html