You are working as an AWS Architect for a global media firm. They have web servers deployed on EC2 instances across multiple regions. For audit purposes, you have created a CloudTrail trail that delivers the CloudTrail event log files to the S3 bucket
This trail applies to all regions & delivers the CloudTrail event log files to the S3 buckets in the EU-Central region. During last year’s audit, auditors have raised a query on the integrity of log files that are delivered to the S3 buckets and raised a Non-Compliance flag against them. Which feature could help you to gain compliance from Auditors for given issue?

Answer options:

A.Use Amazon SSE-S3 encryption for the CloudTrail log file while storing it to S3 buckets.
B.Use Amazon SSE-KMS encryption for CloudTrail log file while storing it to S3 buckets.
C.Use an S3 bucket policy to grant access to only Security head for S3 buckets having CloudTrail log files.
D.Enable the CloudTrail log file integrity validation feature.

Correct Answer: D
To determine whether a log file was modified, deleted, or unchanged after CloudTrail delivered it, you can use CloudTrail log file integrity validation. This feature is built using industry-standard algorithms: SHA-256 for hashing and SHA-256 with RSA for digital signing. This makes it computationally infeasible to modify, delete or forge CloudTrail log files without detection. 
Option A is incorrect as, by default, all CloudTrail log files are delivered to S3 buckets using SSE-S3 encryption. This will not ensure the integrity of log files.
Option B is incorrect as with Amazon SSE-KMS encryption for CloudTrail log files. There would be an additional layer of security for log files. But it won’t ensure the integrity of log files.
Option C is incorrect as this will restrict access to the bucket. But it won’t ensure that no modification has been done to log files post delivering in S3 buckets.
For more information on CloudTrail Log files Integrity, please refer to the following URLs-
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html
https://aws.amazon.com/blogs/aws/aws-cloudtrail-update-sse-kms-encryption-log-file-integrity-verification/