Examkin

Question

Difficulty: EasySecurity Logging, Monitoring, and Auditing

A security analyst needs to determine which IAM user made a specific API call to delete an Amazon S3 bucket last week. Which AWS service should the analyst use to retrieve this API history?

  1. A
    Amazon CloudWatch
  2. B
    Amazon GuardDuty
  3. AWS CloudTrailAnswer
  4. D
    AWS Managed OS Security Logs

Answer

AWS CloudTrail
AWS CloudTrail is the AWS service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. It records API calls and user actions, allowing security teams to pinpoint who made a call, when it occurred, and from which IP address.

Step-by-Step Solution

1
Identify the core requirement of the scenario.
The requirement is to trace user identity and API actions (specifically the deletion of an S3 bucket).
This is an auditing and compliance task that requires access to API transaction logs.
2
Evaluate the capabilities of the primary logging and monitoring services in AWS.
AWS CloudTrail is the dedicated service that records API activity, whereas Amazon CloudWatch monitors metrics/operational logs, Amazon GuardDuty performs threat analysis, and OS-level logging is a customer responsibility.
Matching the requirement with the correct service leads to AWS CloudTrail as the correct tool.

Key Concept

API Auditing and User Activity Tracking
Estimated Time:45s
Rate this question

Topics

Security Logging, Monitoring, and Auditing

More questions from this topic