A security audit requires integrity validation for CloudTrail log files stored in S3. Which capability should be evaluated?

1. Rename each log file to include verified and omit cryptographic validation.
2. Assume object encryption alone proves no authorized caller ever altered a log file.
3. Allow all users to overwrite logs so they can correct audit mistakes.
4. Enable supported CloudTrail log file integrity validation and perform validation using its digest chain.