An airline's booking service writes request logs to a CloudWatch Logs log group. The logs sometimes include passenger names and partial payment card numbers, which the service writes by mistake in a few code paths.
The security team requires that the log group be encrypted with a customer managed KMS key. Engineers should still be able to search the logs, but the sensitive values must be masked in what they see, and any appearance of such values must be recorded for the audit team.
The team does not want to change the booking service's code before the next release.
Which TWO actions meet these requirements? (Choose two.)
Choose two answers.
AA. Turn on server-side encryption for the log group's S3 export bucket with an AWS managed key, and set the log group to forward a copy of its events to that bucket.
BB. Associate the customer managed KMS key with the log group, so that every event stored in that log group is encrypted with the key.
CC. Delete the log lines that contain passenger data with a scheduled Lambda function that runs each hour, so that the sensitive values never remain in the log group for long.
DD. Create a metric filter that counts the log lines containing card-like numbers, and alarm when the count rises, so that the security team learns about each leak.
EE. Add a data protection policy to the log group that audits and masks passenger names and card numbers in its events, so that the values are masked when engineers view them while the audit findings are recorded.
C. Wrong: Deleting lines removes evidence the audit team needs, and an hourly job leaves the values visible until it runs. It also adds a function the team must maintain.
A customer managed KMS key associated with the log group encrypts its events, and a data protection policy masks sensitive identifiers when engineers view them while recording findings for audit. Neither needs a code change. Encrypting an unrelated export bucket, deleting log lines and counting leaks with a metric filter each miss part of the requirement.
Want more on Log collection, retention, encryption and subscriptions? The 5 full-length practice sets have 13 more Log collection, retention, encryption and subscriptions questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →