Question

A financial services company must retain cloud audit logs for seven years to satisfy regulatory requirements. During a recent compliance audit, investigators raised concerns that a privileged administrator could tamper with or delete logs to hide malicious activity. Which control best ensures the integrity and non-repudiation of the retained audit logs?

Accepted Answer

Write logs to an object storage bucket configured with write-once-read-many (WORM) object lock in compliance mode

Answer

Enable server-side encryption on the log storage bucket using a customer-managed key

Answer

Grant only the security team read-only IAM permissions to the log bucket

Answer

Configure lifecycle policies to transition logs to archival storage after 30 days