Examkin

Question

Difficulty: EasySecurity Monitoring and Threat Detection

A gaming company needs to audit and record all API activity across its AWS account to determine who made specific configuration changes, such as modifying IAM policies or deleting resources. Which AWS service should the solutions architect recommend to continuously monitor and record these API actions?

  1. A
    Amazon VPC Flow Logs
  2. B
    AWS Shield
  3. AWS CloudTrailAnswer
  4. D
    AWS Budgets

Answer

AWS CloudTrail
AWS CloudTrail records AWS API calls and management events for your AWS account. It logs details about the caller identity, the time of the action, the specific API requested, and the response. This directly enables tracking of actions like resource deletion and IAM policy changes.

Step-by-Step Solution

1
Identify the primary requirement from the scenario, which is to audit and record administrative API actions and resource changes in an AWS account.
The requirement is for API-level auditing and tracking of identity and actions.
This helps narrow down the services that record management events.
2
Evaluate AWS CloudTrail against this requirement.
AWS CloudTrail log files contain metadata about the API call, including the identity of the API caller, the time, the source IP address, and the request parameters.
CloudTrail is the native AWS service built specifically for auditing account activity.
3
Verify that alternative services like Amazon VPC Flow Logs, AWS Shield, and AWS Budgets do not meet this administrative API tracking requirement.
These alternative services serve different network, security, and cost management functions.
Eliminating distractors ensures the chosen solution is correct and aligned with best practices.

Key Concept

AWS CloudTrail is the primary service for monitoring, auditing, and recording API activity and actions taken across AWS infrastructure.

Alternative Method

Instead of checking CloudTrail logs manually in S3, you can query CloudTrail Event History directly in the console for the last 90 days of management events.
Estimated Time:45s
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic