DOP-C02 Question 261
Select 3Your organization is using AWS CloudTrail to capture API activity across multiple AWS accounts. Recently, you identified unauthorized access to an S3 bucket in one of the accounts and need to investigate further. To pinpoint the source of the unauthorized access, which of the following actions should you take using the CloudTrail logs?
- A
Search the CloudTrail event history for 's3:GetObject' events to identify the source IP address and user identity involved in the access.
- B
Use the CloudTrail logs to filter events by the specific S3 bucket ARN to narrow down the unauthorized actions.
- C
Enable CloudTrail Insights to automatically detect and flag unusual activity related to the S3 bucket.
- D
Analyze the CloudTrail logs for events with an 'errorCode' field set to 'AccessDenied' for the bucket.
- E
Inspect the 'eventSource' field in CloudTrail logs to confirm if the unauthorized access originated from AWS services or an external IAM user.
Show answer and explanation
Correct answers: A, B, E
Explanation
To identify the source of unauthorized access using CloudTrail logs, you should search for relevant 's3:GetObject' events to gather details like source IP and user identity. Filtering by the S3 bucket ARN helps focus the investigation on the specific resource. Additionally, examining the 'eventSource' field confirms whether the activity originated internally or externally. CloudTrail Insights is not helpful for past events, and 'AccessDenied' is not relevant because the unauthorized access succeeded.
- A. Correct.
Correct. Searching for 's3:GetObject' events in the CloudTrail event history will help you identify the exact API calls made to access the S3 bucket, along with details like source IP address and user identity.
- B. Correct.
Correct. Filtering CloudTrail logs by the specific S3 bucket ARN can help you focus on the events related to that bucket and narrow down unauthorized actions.
- C. Incorrect.
Incorrect. CloudTrail Insights can detect unusual activity patterns, but it is not a retrospective feature and would not help you analyze past events for this incident.
- D. Incorrect.
Incorrect. While 'AccessDenied' events can indicate unauthorized attempts, in this scenario, the unauthorized access succeeded, so these events would not be relevant.
- E. Correct.
Correct. Inspecting the 'eventSource' field can help you determine whether the activity originated from AWS services or an external IAM user, providing more context for the investigation.