Examkin

Question

Difficulty: EasySecurity Logging, Monitoring, and Auditing

A startup is preparing for a security audit and needs to generate a report showing who made specific API requests to modify their Amazon EC2 instances over the last thirty days. Which AWS service should the startup use to retrieve this API transaction history?

  1. A
    Amazon CloudWatch
  2. B
    Amazon GuardDuty
  3. AWS CloudTrailAnswer
  4. D
    AWS Trusted Advisor

Answer

AWS CloudTrail is the service designed to track and log user activity and API calls across AWS infrastructure for auditing and compliance.
AWS CloudTrail is specifically built to log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. This service provides a complete history of API calls, including the identity of the API caller, the time of the call, the source IP address, and the request parameters, making it the correct choice for generating an audit report.

Step-by-Step Solution

1
Identify the primary requirement in the scenario.
The requirement is to retrieve a history of API requests showing who modified Amazon EC2 resources.
This establishes that the solution must focus on administrative tracking, logging, and auditing of API activity.
2
Evaluate the capabilities of the available AWS monitoring and security services.
AWS CloudTrail records user actions and API calls, whereas Amazon CloudWatch monitors performance metrics, Amazon GuardDuty detects security threats, and AWS Trusted Advisor checks configuration best practices.
Choosing the service that specifically records API transaction histories ensures compliance auditing needs are met.

Key Concept

AWS CloudTrail is used to audit user activity and API calls, while Amazon CloudWatch is used for performance monitoring and operational metrics.
Estimated Time:45s
Rate this question

Topics

Security Logging, Monitoring, and Auditing

More questions from this topic