Question

A cloud security engineer is designing the logging architecture for a regulated healthcare SaaS platform. Auditors require that once an access log entry is written, no administrator — including those with root-level cloud console privileges — can alter or delete individual records without detection during the mandated retention window. Which control BEST satisfies this requirement?

Accepted Answer

Store logs in a write-once-read-many (WORM) object storage bucket configured with immutability/object-lock in compliance mode for the retention period

Answer

Encrypt the log files at rest with a customer-managed key stored in an HSM and restrict decryption to auditors

Answer

Forward all logs to a SIEM and configure hourly automated backups to a separate region

Answer

Apply strict IAM role-based access controls so only the security team can modify the log repository