Examkin

Question

Difficulty: MediumSecurity Logging, Monitoring, and Auditing

A financial services company needs to investigate an incident where a critical Amazon RDS database instance was unexpectedly deleted. The security team must identify the specific IAM user who initiated the deletion, the exact time of the API call, and the source IP address of the request. Which AWS service should the security team use to retrieve this historical record of API activity?

  1. A
    Amazon CloudWatch
  2. B
    Amazon GuardDuty
  3. AWS CloudTrailAnswer
  4. D
    AWS Artifact

Answer

AWS CloudTrail
AWS CloudTrail is designed to record API calls and user interactions across AWS infrastructure. It provides detailed records of who made a request, from where, and at what time, which is essential for security auditing and forensic analysis.

Step-by-Step Solution

1
Identify the goal of the security team, which is to audit API activity to determine who deleted an Amazon RDS database instance, when the action occurred, and from what source IP.
The team needs a service that logs and indexes administrative activity and management console operations.
This is an auditing and compliance task focused on tracking user actions and API usage.
2
Compare the capabilities of available AWS logging and monitoring services to find the one that tracks API calls.
AWS CloudTrail records management events, showing user identities, API calls, timestamps, and source IP addresses.
Selecting the service specifically designed for tracking account-wide API operations ensures the team can retrieve the required history.

Key Concept

AWS CloudTrail is the primary service for auditing and recording AWS API activity, tracking user actions, console logins, and service operations.
Estimated Time:1m 0s
Rate this question

Topics

Security Logging, Monitoring, and Auditing

More questions from this topic