DOP-C02 Question 260
Select 4Your organization uses AWS CloudTrail to monitor API activity across multiple accounts in an AWS Organization. Recently, a security audit revealed unauthorized actions performed by an IAM user in one of the member accounts. You need to analyze the AWS CloudTrail logs to identify the specific API calls made by this user and ensure future unauthorized actions can be detected and alerted upon. Which steps should you take to achieve this?
- A
Use the AWS CloudTrail Event History in the AWS Management Console to filter logs by the IAM user’s name and analyze the API actions.
- B
Enable CloudTrail Insights to detect unusual API activity patterns within the AWS Organization.
- C
Create an Amazon EventBridge rule to trigger an alert whenever the IAM user performs specific API actions.
- D
Configure a CloudWatch Logs Insights query to search for API calls made by the IAM user in the CloudTrail logs.
- E
Enable S3 bucket logging for the CloudTrail log file storage bucket to monitor access to the logs.
Show answer and explanation
Correct answers: A, B, C, D
Explanation
To analyze and detect unauthorized actions by an IAM user, you need to use tools like CloudTrail Event History for quick filtering, CloudWatch Logs Insights for advanced log queries, and CloudTrail Insights for unusual activity detection. Additionally, setting up EventBridge rules ensures you can proactively monitor and alert for specific actions. S3 bucket logging, while useful for monitoring access to logs, is not directly relevant for analyzing the IAM user's API activity.
- A. Correct.
Correct: The AWS CloudTrail Event History allows you to filter logs by attributes like the IAM user’s name, providing a quick way to identify specific API actions.
- B. Correct.
Correct: Enabling CloudTrail Insights helps detect unusual API activity patterns, which could indicate unauthorized actions.
- C. Correct.
Correct: Amazon EventBridge rules can be used to define specific actions or patterns to monitor, enabling proactive alerts for unauthorized activities.
- D. Correct.
Correct: CloudWatch Logs Insights can be used to run advanced queries against CloudTrail logs, making it an efficient option for analyzing activity.
- E. Incorrect.
Incorrect: While enabling S3 bucket logging provides visibility into access to the CloudTrail log storage bucket, it does not directly help in identifying or analyzing the IAM user's API activity.