Examkin

Soru

Zorluk: OrtaSecurity Logging, Monitoring, and Auditing

A financial services company needs to investigate an incident where a critical Amazon RDS database instance was unexpectedly deleted. The security team must identify the specific IAM user who initiated the deletion, the exact time of the API call, and the source IP address of the request. Which AWS service should the security team use to retrieve this historical record of API activity?

  1. A
    Amazon CloudWatch
  2. B
    Amazon GuardDuty
  3. AWS CloudTrailCevap
  4. D
    AWS Artifact

Cevap

AWS CloudTrail
AWS CloudTrail is designed to record API calls and user interactions across AWS infrastructure. It provides detailed records of who made a request, from where, and at what time, which is essential for security auditing and forensic analysis.

Adım Adım Çözüm

1
Identify the goal of the security team, which is to audit API activity to determine who deleted an Amazon RDS database instance, when the action occurred, and from what source IP.
The team needs a service that logs and indexes administrative activity and management console operations.
This is an auditing and compliance task focused on tracking user actions and API usage.
2
Compare the capabilities of available AWS logging and monitoring services to find the one that tracks API calls.
AWS CloudTrail records management events, showing user identities, API calls, timestamps, and source IP addresses.
Selecting the service specifically designed for tracking account-wide API operations ensures the team can retrieve the required history.

Anahtar Kavram

AWS CloudTrail is the primary service for auditing and recording AWS API activity, tracking user actions, console logins, and service operations.
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Security Logging, Monitoring, and Auditing

Bu konudan daha fazla soru