ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Non-repudiation requires evidence that an action was performed by a specific principal and that the evidence cannot be altered without detection. Enabling AWS CloudTrail captures every API call together with the caller's identity and signs each log file with a SHA-256 hash and public-key signature. Turning on CloudTrail's log file integrity validation lets you verify that logs have not been modified, while S3 versioning and MFA Delete protect the evidence from tampering or deletion. AWS WAF and Shield improve availability but do not bind actions to identities. Server-side encryption and Object Lock secure stored objects but do not record who performed an action or provide cryptographic validation of logs. Replicating data in DynamoDB enhances durability and availability, not non-repudiation.