A fintech company suspects an EC2 web fleet was compromised overnight. Legal requires tamper-evident system and application logs preserved for investigation with clear chain of custody and no modification for one year. Which forensic log preservation strategy should the responder implement to retain admissible system and application evidence?
Select an answer to reveal the explanation.
Short Explanation
Your evidence locker needs a wax seal, and you've got it here with immutability plus validation. Locking the central bucket with Object Lock stops edits while CloudTrail validation proves nothing was altered.
Full Explanation
The correct approach centralizes forensic copies in S3 with Object Lock in Compliance mode (Governance mode lets privileged users bypass retention) to enforce write-once-read-many retention and uses CloudTrail log file validation with digest files to detect tampering of the API audit trail alongside the Object Lock retention on the host and application log copies, preserving chain of custody across accounts and satisfying admissibility needs for system and application logs forwarded via CloudWatch agent, Kinesis Firehose, or VPC Flow Logs delivery. Streaming only to CloudWatch Logs fails by concept because default retention expires and logs remain mutable without vault-style immutability, while storing logs on EBS volumes and AMIs fails because local storage is ephemeral, co-mingled with the compromised host, and easily altered by an attacker with instance access. Forwarding to OpenSearch fails because search analytics prioritize indexing and correlation rather than immutable long-term evidence storage, with snapshots still mutable and costly for year-long retention. For the exam, remember preservation means separate immutable central copy plus integrity proof, not just collection, and in practice verify bucket policies deny delete, enable cross-account delivery, and test restore of log digests before an incident.