DOP-C02 Question 259
Select 3Your organization has enabled AWS CloudTrail across all regions in your AWS account to monitor API activity. Recently, a security incident investigation revealed unauthorized attempts to stop EC2 instances. As part of improving security and monitoring, you want to set up a solution to detect and send alerts whenever 'StopInstances' API calls are made. Which of the following steps should you take to achieve this goal?
- A
Create a CloudTrail trail and configure it to capture global events.
- B
Enable CloudTrail logs to be delivered to an Amazon S3 bucket.
- C
Create a CloudWatch Logs metric filter to detect 'StopInstances' API calls in the CloudTrail logs.
- D
Set up an Amazon SNS topic and subscribe your security team to the topic.
- E
Create a CloudWatch alarm based on the metric filter and configure it to notify the SNS topic.
Show answer and explanation
Correct answers: C, D, E
Explanation
To detect and alert on specific API calls like 'StopInstances', you need to create a CloudWatch Logs metric filter to parse CloudTrail logs for the desired API activity. Once the metric filter is in place, you can create a CloudWatch alarm that triggers when the filter detects occurrences of the 'StopInstances' API call. Finally, you set up an SNS topic to notify the security team when the alarm is triggered. While enabling CloudTrail and delivering logs to an S3 bucket are important for monitoring and auditing, they are not directly part of the detection and alerting mechanism in this scenario.
- A. Incorrect.
CloudTrail trails must already be enabled to capture API activity, including 'StopInstances' events. However, this step is not specific to the solution for detecting and alerting on the 'StopInstances' API calls. It is assumed to already be in place.
- B. Incorrect.
Delivering CloudTrail logs to an S3 bucket is useful for log archival and analysis, but it is not directly required for real-time detection or alerting.
- C. Correct.
Creating a CloudWatch Logs metric filter is essential to identify specific API calls, such as 'StopInstances', from the CloudTrail logs.
- D. Correct.
Setting up an SNS topic and subscribing the security team allows the team to receive notifications when the alarm related to 'StopInstances' API calls is triggered.
- E. Correct.
Creating a CloudWatch alarm based on the metric filter is necessary to generate alerts when 'StopInstances' API calls are detected.