DOP-C02 Question 391
Select 3Your company has a multi-account AWS environment and wants to implement centralized security monitoring and auditing. The goal is to detect unauthorized activities and ensure compliance across all accounts. The solution must be scalable, provide real-time insights, and integrate with existing logging systems. Which combination of actions should you take to meet this requirement?
- A
Enable AWS CloudTrail in every account and configure it to deliver logs to a central S3 bucket in the monitoring account.
- B
Set up Amazon GuardDuty in every account and configure centralized findings aggregation in the monitoring account.
- C
Use AWS Config in each account to monitor resource compliance and aggregate configuration data in a single account.
- D
Deploy Amazon Macie to the monitoring account to automatically monitor all accounts for sensitive data.
- E
Create a custom Lambda function to parse CloudTrail logs and send security events to Amazon SNS for notification.
Show answer and explanation
Correct answers: A, B, C
Explanation
The combination of AWS CloudTrail, Amazon GuardDuty, and AWS Config provides a robust, scalable, and AWS-native solution for centralized security monitoring and auditing in a multi-account environment. CloudTrail ensures all API activity is logged, GuardDuty provides real-time threat detection, and AWS Config monitors compliance. Together, these services meet the requirements of the scenario effectively.
- A. Correct.
Enabling AWS CloudTrail in all accounts and centralizing logs in a shared S3 bucket ensures that all API activity is logged and can be monitored in a single location, which is essential for auditing and compliance.
- B. Correct.
Amazon GuardDuty provides real-time threat detection and supports centralized findings aggregation, making it a scalable solution for security monitoring across a multi-account environment.
- C. Correct.
AWS Config is used to monitor configurations and compliance across resources. Aggregating data in a central account provides a unified view of compliance status, aligned with the requirement.
- D. Incorrect.
Amazon Macie is primarily focused on discovering and protecting sensitive data such as PII. While useful, it does not address the broader requirement of centralized security monitoring and auditing.
- E. Incorrect.
Although a custom Lambda function could process CloudTrail logs, this approach does not leverage AWS-native services designed for security monitoring and would require significant custom development.