DEA-C01 Question 371
Select 2Your company wants to monitor and log access to AWS services to improve security and compliance. Which of the following steps should you take to log access to AWS services effectively?
- A
Enable AWS CloudTrail in all regions to track API activity and service usage.
- B
Configure detailed monitoring in Amazon CloudWatch for all services.
- C
Set up Amazon S3 bucket policies to store CloudTrail logs securely.
- D
Enable AWS Config to monitor configuration changes across resources.
- E
Use VPC Flow Logs to capture all incoming and outgoing traffic for services.
Show answer and explanation
Correct answers: A, C
Explanation
To log access to AWS services effectively, you need to enable AWS CloudTrail, which tracks API calls and service usage. Furthermore, securely storing CloudTrail logs in an Amazon S3 bucket with proper policies ensures log integrity and security. While options like AWS Config and VPC Flow Logs are useful for other monitoring purposes, they are not designed to log direct access to AWS services.
- A. Correct.
Enabling AWS CloudTrail in all regions is critical to logging API activity and service usage across an AWS account. It provides event history for actions taken through the AWS Management Console, CLI, SDKs, and other services.
- B. Incorrect.
CloudWatch detailed monitoring provides metrics at a higher resolution but does not log API access or service usage. It is not specifically designed for logging access to AWS services.
- C. Correct.
Configuring an Amazon S3 bucket with secure policies ensures the safe storage of CloudTrail logs. This step is necessary for maintaining log integrity and security.
- D. Incorrect.
AWS Config tracks configuration changes and compliance, but it does not log access to AWS services or API calls.
- E. Incorrect.
VPC Flow Logs capture network traffic data but do not provide logging for API activity or AWS service access.