Examkin

Soru

Zorluk: KolaySecurity Logging, Monitoring, and Auditing

A security analyst needs to determine which IAM user made a specific API call to delete an Amazon S3 bucket last week. Which AWS service should the analyst use to retrieve this API history?

  1. A
    Amazon CloudWatch
  2. B
    Amazon GuardDuty
  3. AWS CloudTrailCevap
  4. D
    AWS Managed OS Security Logs

Cevap

AWS CloudTrail
AWS CloudTrail is the AWS service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. It records API calls and user actions, allowing security teams to pinpoint who made a call, when it occurred, and from which IP address.

Adım Adım Çözüm

1
Identify the core requirement of the scenario.
The requirement is to trace user identity and API actions (specifically the deletion of an S3 bucket).
This is an auditing and compliance task that requires access to API transaction logs.
2
Evaluate the capabilities of the primary logging and monitoring services in AWS.
AWS CloudTrail is the dedicated service that records API activity, whereas Amazon CloudWatch monitors metrics/operational logs, Amazon GuardDuty performs threat analysis, and OS-level logging is a customer responsibility.
Matching the requirement with the correct service leads to AWS CloudTrail as the correct tool.

Anahtar Kavram

API Auditing and User Activity Tracking
Tahmini Süre:45s
Bu soruyu puanla

Konular

Security Logging, Monitoring, and Auditing

Bu konudan daha fazla soru