What's changed: In-scope coverage (fix): added AWS WAF (L7 web protection; SQLi/XSS/rate-limit via IaC) to the Network Firewall block (closes an Axis-B textbook gap)
6.3Data Protection and Auditing
Understand data protection and trails—KMS (encryption), encryption at rest/in transit, CloudTrail (API auditing), S3 Object Lock/versioning, and tamper-proof trails. Meet compliance requirements.
Compliance requires encryption and audit trails. Encrypt with KMS, record actions with CloudTrail, and prevent tampering.
6.3.1Encryption and auditing
- KMS: at-rest encryption (envelope encryption, key rotation) for S3/EBS/RDS, etc.
- In-transit encryption: protect traffic with TLS.
- CloudTrail: audit API actions; aggregate all accounts with an organization trail.
- Object Lock/versioning: protect logs/trails from tampering/deletion with WORM.
Common on DOP-C02: at-rest encryption/key management = KMS (envelope, rotation), API auditing = CloudTrail (organization trail), tamper-proof trails = S3 Object Lock (WORM) + versioning, continuous compliance like mandatory encryption = Config. Protecting the CloudTrail logs themselves (dedicated account + WORM) is commonly tested.
DOP-C02 probes whether you can automate and preserve data protection and audit trails to meet compliance requirements. KMS provides scalable at-rest encryption via envelope encryption (data keys encrypted by a master key), integrating with S3/EBS/RDS/Secrets Manager, etc. Customer-managed keys (CMKs) control cross-account use and rotation via key policies, using multiple keys for separation of duty. Protect data in transit with TLS, and S3 can require aws:SecureTransport via bucket policy. For auditing, CloudTrail records management and data events, and an organization trail centralizes trails across all member accounts. To preserve the trail itself, collect logs into a dedicated log-archive account, prevent tampering/deletion with S3 Object Lock (WORM) + versioning + MFA Delete, and detect tampering with CloudTrail log-file integrity validation (digests). AWS Config continuously evaluates compliance with rules like "S3 must be encrypted" or "CloudTrail must be enabled," auto-remediating drift. The design key is to isolate and protect trails from their source and enforce encryption, retention, and access control via policy (IaC)—meeting audit/regulatory requirements (PCI DSS, HIPAA, etc.).
| Protection/audit target | Means | Key point |
|---|---|---|
| Encrypt data at rest | KMS (CMK) | Envelope encryption; key rotation |
| Encrypt in transit | TLS | Require aws:SecureTransport |
| Audit API actions | CloudTrail (org trail) | Mgmt/data events; all-account aggregation |
| Tamper-proof trails | S3 Object Lock + versioning | WORM; dedicated account; integrity validation |
Scenario: An audit requires "retain API logs for all accounts for 7 years, immutable even to administrators." → Use a CloudTrail organization trail to aggregate all members’ trails into S3 in a dedicated log-archive account, apply Object Lock (compliance mode) + versioning for WORM protection, and enable log-file integrity validation. Restrict access to least privilege, encrypt with KMS, and continuously evaluate "CloudTrail enabled / S3 encrypted" with Config rules.
FAQ: CloudTrail vs AWS Config vs CloudWatch Logs? CloudTrail audits "who called which API, when"; Config evaluates/records "resource configuration state and compliance"; CloudWatch Logs aggregates/searches "arbitrary app/OS logs." Choose by role: CloudTrail for auditing, Config for configuration compliance, CloudWatch Logs for application logs.
Exam trap: Using CloudTrail for "application log collection" is wrong—that is CloudWatch Logs. CloudTrail is solely for API-action auditing. Also, storing trails in the same account as the source or a deletable-by-anyone S3 lacks tamper resistance; protect with a dedicated account + Object Lock (WORM).
6.3.2Certificates and dedicated key management (ACM, CloudHSM)
For encryption in transit (TLS) and key storage, dedicated services are chosen by purpose. Certificate Manager (ACM) provisions and auto-renews TLS/SSL certificates for free, integrating with ELB, CloudFront, and API Gateway. Its key value is preventing expiry incidents via automatic renewal—DevOps can structurally eliminate "outages from a missed manual cert renewal" (ACM-issued certs are bound to supported services and cannot be exported). CloudHSM (AWS CloudHSM) is a single-tenant dedicated hardware security module where you fully own and manage keys; the current hsm2m type is FIPS 140-3 Level 3 validated (the older hsm1 type was FIPS 140-2 Level 3). Managed KMS suffices for normal key management, but choose CloudHSM when a regulation mandates a dedicated HSM, or you need key sovereignty or custom cryptographic apps (e.g., PKCS#11)—it can also back a KMS custom key store.
6.3.3Section summary
- Encryption = KMS (at rest) + TLS (in transit)
- Audit = CloudTrail (org trail) + WORM/versioning protection
- Certificates = ACM (auto-renew prevents expiry) / dedicated HSM = CloudHSM (regulation, key sovereignty)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want centralized encryption keys with envelope encryption and key rotation for data at rest. What?
Q2. You want to protect the CloudTrail audit logs themselves from deletion/tampering. How?
Q3. You want to centrally aggregate API audit logs across all accounts in the organization. What?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.