Examkin

Question

Difficulty: HardSecurity Monitoring, Logging, and Compliance Auditing

A SysOps Administrator is auditing a multi-account environment where AWS CloudTrail logs are consolidated into a central Amazon S3 bucket. The logs and digest files are encrypted using an AWS KMS customer managed key. During a compliance check, the administrator runs the AWS CLI command to verify log file integrity, but the command fails with an access denied error on decryption. Additionally, the compliance team reports that read-only API activity, such as listing S3 objects and describing EC2 instances, is missing from the logs, although resource modifications are successfully recorded. Which two actions should the SysOps Administrator take to resolve these issues? (Select TWO.)

  1. Update the CloudTrail trail configuration to capture All Read/Write events instead of write-only events.Answer
  2. Ensure that the IAM identity executing the log validation command has kms:Decrypt and kms:DescribeKey permissions for the customer managed key.Answer
  3. C
    Configure the IAM policy of the administrator with the iam:PassRole permission targeting the CloudTrail service role.
  4. D
    Modify the S3 bucket policy to grant the CloudTrail service principal the s3:GetObject permission on the digest files prefix.
  5. E
    Enable Amazon CloudWatch detailed monitoring to capture high-frequency read-only management events.

Answer

Updating the CloudTrail trail configuration to capture all Read/Write events, and ensuring the IAM identity executing the validation has decrypt permissions on the customer managed key.
To resolve the missing read-only events, the CloudTrail configuration must be updated to log all events rather than write-only events. For the validation failure, the administrator's local machine performs the validation by retrieving the logs and decrypting them, meaning the IAM identity running the command must have permissions to decrypt using the KMS customer managed key.

Step-by-Step Solution

1
Identify the cause of the missing read-only events by checking the trail configuration.
The trail's event selector is configured for write-only events.
By default or by custom configuration, write-only logging excludes read-only API calls such as Describe and List actions.
2
Modify the event selector of the CloudTrail trail.
Change the setting to record 'All' events (both Read and Write).
This ensures both management modifications and read-only API calls are captured in the S3 bucket.
3
Diagnose the log validation failure.
The AWS CLI verify-log-file-consistency command fails with a decryption error.
The validation process runs locally on the administrator's machine, requiring the user's IAM credentials to download and decrypt the logs using the custom KMS key.
4
Update the policy of the customer managed key to grant decryption permissions to the validator's IAM identity.
Add kms:Decrypt and kms:DescribeKey permissions for the administrator's IAM user or role.
This allows the client executing the validation command to successfully decrypt the digests and verify log file integrity.

Key Concept

CloudTrail Log Auditing and Integrity Validation
Rate this question

Topics

Security Monitoring, Logging, and Compliance Auditing

More questions from this topic