DOP-C02 Question 394
Select 3Your organization has a requirement to monitor and audit all API calls made to AWS resources for security and compliance purposes. You also need to detect unusual activity, such as unauthorized access attempts, and send alerts in near real-time. Which combination of services should you implement to meet these requirements?
- A
Enable AWS CloudTrail to capture API activity logs
- B
Use Amazon GuardDuty to detect unusual and unauthorized activity
- C
Configure Amazon Macie to monitor API access patterns for sensitive data
- D
Set up Amazon CloudWatch Alarms to monitor specific metrics and send alerts
- E
Enable AWS Config to track configuration changes to AWS resources
Show answer and explanation
Correct answers: A, B, D
Explanation
To implement a comprehensive security monitoring and auditing solution, you need to enable AWS CloudTrail to capture API activity logs, use Amazon GuardDuty to detect unusual activity such as unauthorized access, and set up Amazon CloudWatch Alarms to generate alerts for specific security events. While other services like Amazon Macie and AWS Config serve important security and compliance functions, they do not directly fulfill the requirements outlined in this scenario.
- A. Correct.
Enabling AWS CloudTrail is essential for capturing API activity logs, which provide a detailed audit trail for monitoring and compliance.
- B. Correct.
Amazon GuardDuty is a threat detection service that can identify unusual and unauthorized activity, such as compromised credentials or anomalous API usage.
- C. Incorrect.
Amazon Macie is used to detect and protect sensitive data like personally identifiable information (PII) but is not directly used for monitoring API access patterns or detecting unauthorized activity.
- D. Correct.
Amazon CloudWatch Alarms can be configured to monitor specific metrics, such as unauthorized API calls or changes in usage patterns, and trigger alerts in near real-time.
- E. Incorrect.
AWS Config is primarily used to track configuration changes to resources and ensure compliance with security policies, but it does not directly monitor API activity or detect unauthorized access.