Examkin

Question

Difficulty: MediumSecurity Logging, Monitoring, and Auditing

A financial services firm wants to audit user activity in its AWS account to ensure compliance. They need to keep a complete record of all API transactions, and they also want to receive real-time notifications if anyone attempts to modify security group rules. Which combination of AWS services should the company implement to achieve this? (Select TWO.)

  1. AWS CloudTrail to log and track API calls across the account.Answer
  2. Amazon CloudWatch Alarms to monitor log events and send alerts for security group changes.Answer
  3. C
    Amazon GuardDuty to log all API calls and archive them to an Amazon S3 bucket for auditing.
  4. D
    Amazon Inspector to audit user console logins and raise real-time alarms.
  5. E
    AWS Artifact to automatically record and monitor changes to security group configurations.

Answer

To audit all API transactions and receive real-time notifications for security group changes, the company should configure AWS CloudTrail to log API activity and use Amazon CloudWatch Alarms to monitor the logs and trigger alerts.
Deploying AWS CloudTrail allows the company to log, continuously monitor, and retain account activity related to actions across their AWS infrastructure. To receive real-time notifications for modifications to security group rules, the company can deliver CloudTrail logs to Amazon CloudWatch Logs and configure Amazon CloudWatch Alarms to trigger alerts based on specific log patterns.

Step-by-Step Solution

1
Identify the service responsible for auditing and logging AWS API actions.
AWS CloudTrail is identified as the service that records API calls, user activity, and resource changes across the AWS infrastructure.
Tracking user activity and API transaction history is a core capability of AWS CloudTrail.
2
Determine how to monitor logs and trigger notifications for specific events like security group modifications.
Amazon CloudWatch Logs can receive CloudTrail logs, and CloudWatch Alarms can trigger alerts (such as via Amazon SNS) based on metric filters for security group modification events.
Amazon CloudWatch is designed for real-time monitoring and alerting based on log patterns and resource metrics.

Key Concept

AWS CloudTrail is used for auditing and tracking API activity, while Amazon CloudWatch is used for monitoring resource performance, logs, and setting up alarms.
Rate this question

Topics

Security Logging, Monitoring, and Auditing

More questions from this topic