DEA-C01 Question 522
Select 3You are a data engineer working for an organization that heavily uses AWS services like Amazon S3, Amazon Redshift, and AWS Glue. The security team has requested that you enable logging for access to these services to monitor potential unauthorized access or anomalies. Which of the following actions should you take to meet this requirement?
- A
Enable AWS CloudTrail and configure it to log management and data events.
- B
Enable S3 access logs for all S3 buckets storing sensitive data.
- C
Configure AWS Config to track API calls and resource changes.
- D
Enable Amazon Redshift Audit Logging for tracking queries and connections.
- E
Set up VPC Flow Logs to capture detailed access patterns for services.
Show answer and explanation
Correct answers: A, B, D
Explanation
To log access to AWS services effectively, multiple logging mechanisms should be used depending on the specific service. AWS CloudTrail provides a centralized way to log API calls for most AWS services, S3 access logs capture detailed access information for S3 buckets, and Redshift Audit Logging captures activity within Amazon Redshift. AWS Config and VPC Flow Logs serve different purposes and are not directly relevant to logging access to AWS services.
- A. Correct.
Correct. AWS CloudTrail is designed to log API calls for AWS services, including management and data events, making it an essential tool for monitoring access to AWS services.
- B. Correct.
Correct. S3 access logs specifically track requests made to S3 buckets, providing detailed information on who accessed the data and when.
- C. Incorrect.
Incorrect. AWS Config is used to track resource configurations and compliance, but it does not log API calls or access to AWS services directly.
- D. Correct.
Correct. Redshift Audit Logging is specifically designed for tracking user activity, queries, and connections within Amazon Redshift.
- E. Incorrect.
Incorrect. VPC Flow Logs monitor network traffic within a VPC and are not designed to capture detailed access patterns for services like S3 or Redshift.