You have enabled CloudTrail logs for your company’s AWS account and store the logs in an S3 bucket. In addition, the IT Security department has mentioned that the logs need to be encrypted. How could this be achieved?

Answer options:

A.Enable SSL certificates for the CloudTrail logs.
B.There is no need to do anything since the logs are encrypted by default.
C.Enable Server-Side Encryption for the trail.
D.Enable Server-Side Encryption for the destination S3 bucket.

Correct Answer – B
AWS Documentation mentions the following.
By default, CloudTrail event log files are encrypted using Amazon S3 server-side encryption (SSE). You can also choose to encrypt your log files with an AWS Key Management Service (AWS KMS) key. You can store your log files in your bucket for as long as you want. You can also define Amazon S3 lifecycle rules to archive or delete log files automatically. If you want notifications about log file delivery and validation, you can set up Amazon SNS notifications.
For more information on how CloudTrail works, please visit the following URL-
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/how-cloudtrail-works.html