Examkin

Question

Difficulty: EasySecurity Logging, Monitoring, and Auditing

A retail company wants to track and record all API activity and user actions across its AWS account for compliance auditing. The company needs to know which user initiated an action, the time of the event, and the IP address from which the request was made. Which AWS service should the company use to meet this requirement?

  1. AWS CloudTrailAnswer
  2. B
    Amazon CloudWatch
  3. C
    Amazon GuardDuty
  4. D
    Amazon Inspector

Answer

AWS CloudTrail
AWS CloudTrail is the AWS service that enables auditing, security monitoring, and operational troubleshooting by recording API actions and console operations. It captures details such as the identity of the caller, the request time, and the source IP address.

Step-by-Step Solution

1
Identify the primary requirement of the scenario.
The requirement is to log and audit user actions and API calls (who did what, when, and from where) across the entire AWS account.
This establishes the need for an auditing service rather than performance monitoring or vulnerability assessment.
2
Evaluate the capabilities of the available AWS security services.
AWS CloudTrail records API history and user activity, which directly matches the auditing and compliance need. Amazon CloudWatch is for metrics/logs, Amazon GuardDuty is for threat detection, and Amazon Inspector is for vulnerability scanning.
Choosing the service that specifically handles user event and API auditing ensures the correct alignment of AWS services.

Key Concept

AWS CloudTrail provides governance, compliance, operational auditing, and risk auditing of your AWS account by logging actions taken by a user, role, or an AWS service.
Rate this question

Topics

Security Logging, Monitoring, and Auditing

More questions from this topic