DOP-C02 Question 262
Select 3Your organization has enabled AWS CloudTrail for logging API activity across multiple AWS accounts in an organization. Recently, a critical S3 bucket was accidentally deleted, and you need to identify which IAM user or role performed this action. Additionally, you want to ensure that in the future, such critical events can be quickly detected and analyzed. Which of the following steps should you take to achieve this requirement?
- A
Search the CloudTrail logs for DeleteBucket events associated with the affected S3 bucket.
- B
Enable CloudTrail Insights to detect unusual operational activities such as bucket deletions.
- C
Use Amazon Athena to query the centralized CloudTrail logs for detailed information about the API call.
- D
Enable S3 server access logging on the bucket to track future deletion events.
- E
Configure an Amazon EventBridge rule to monitor for DeleteBucket API calls and notify the security team.
Show answer and explanation
Correct answers: A, C, E
Explanation
To identify who deleted the S3 bucket, you should review the CloudTrail logs for DeleteBucket events and query them using a tool like Amazon Athena for detailed analysis. Additionally, you should proactively monitor and respond to critical events in the future by configuring EventBridge rules to notify the security team of any DeleteBucket API calls. CloudTrail Insights and S3 server access logging are not sufficient for this use case as they either do not provide the required granularity or are not designed for API-level event tracking.
- A. Correct.
This is correct because CloudTrail logs record all API activity, including DeleteBucket events, which can be searched to identify the user or role responsible for the deletion.
- B. Incorrect.
This is incorrect because CloudTrail Insights is used for detecting unusual patterns or spikes in API activity, but it does not specifically log individual events like bucket deletions.
- C. Correct.
This is correct because Amazon Athena allows you to query CloudTrail logs for detailed information about specific API calls, such as DeleteBucket, including the IAM user or role involved.
- D. Incorrect.
This is incorrect because S3 server access logging captures requests to the S3 bucket but does not provide details about API-level actions like DeleteBucket in the same way CloudTrail does.
- E. Correct.
This is correct because setting up an EventBridge rule to monitor DeleteBucket API calls allows you to proactively alert the security team when such critical actions occur.