Examkin

Question

Difficulty: MediumSecurity Logging, Monitoring, and Auditing

A financial technology firm wants to enhance its operational visibility and security auditing on AWS. The operations team needs to collect and search log files generated by their application running on Amazon EC2 instances, and trigger automated alerts when system errors are detected. Simultaneously, the security team needs to audit all administrative API requests made to AWS resources to identify which user made specific configuration changes. Which AWS services should the firm implement to fulfill these two requirements? (Select TWO.)

  1. AWS CloudTrailAnswer
  2. Amazon CloudWatchAnswer
  3. C
    Amazon GuardDuty
  4. D
    Amazon Inspector
  5. E
    AWS Shield

Answer

AWS CloudTrail and Amazon CloudWatch
The firm should implement AWS CloudTrail and Amazon CloudWatch. AWS CloudTrail is designed to record API calls and user activity across the AWS infrastructure, providing a complete audit trail of who made changes to resources. Amazon CloudWatch, combined with the CloudWatch agent on EC2 instances, is used to collect, monitor, and search application log files, as well as set up metrics and alarms to notify the operations team of system errors in real time.

Step-by-Step Solution

1
Analyze the security auditing requirement to track who made specific configuration changes.
Identify that AWS CloudTrail records API calls, user actions, and resource changes.
This satisfies the requirement to audit administrative actions and trace user activity.
2
Analyze the operational logging requirement to collect application logs from EC2 and trigger alerts on errors.
Identify that Amazon CloudWatch (and CloudWatch Logs) can collect application logs via an agent and create metric filters for alarms.
This fulfills the need for real-time application log monitoring and automated alerting.
3
Evaluate the incorrect options against the requirements.
Rule out Amazon GuardDuty, Amazon Inspector, and AWS Shield as they focus on threat detection, vulnerability scanning, and DDoS protection respectively, rather than general logging and API auditing.
Eliminating distractors ensures a precise and correct selection of the two monitoring services.

Key Concept

AWS CloudTrail is used for auditing AWS API calls and user activity (governance and compliance), while Amazon CloudWatch is used for performance monitoring, application log collection, and metric-based alerting.
Estimated Time:1m 30s
Rate this question

Topics

Security Logging, Monitoring, and Auditing

More questions from this topic