DOP-C02 Question 399
Select 4Your organization has implemented a multi-account AWS architecture and is looking to enhance its security auditing posture. The security team wants to ensure that any configuration changes, network traffic patterns, and unexpected modifications to infrastructure are tracked and monitored across all accounts. Which combination of AWS services and features should you use to achieve this?
- A
Enable AWS CloudTrail for all accounts and configure it to log to a centralized S3 bucket.
- B
Set up AWS Config rules to evaluate resource configurations and ensure compliance.
- C
Use CloudFormation drift detection to identify unexpected changes to CloudFormation-managed resources.
- D
Enable Amazon GuardDuty to monitor and analyze network traffic patterns.
- E
Use VPC Flow Logs to capture detailed information about the IP traffic going to and from network interfaces.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To enhance security auditing across a multi-account AWS architecture, you need to ensure visibility into configuration changes, resource compliance, and network traffic. AWS CloudTrail provides centralized logging for API calls and configuration changes. AWS Config evaluates resource compliance and tracks changes to configurations. CloudFormation drift detection identifies unexpected changes to managed infrastructure. Finally, VPC Flow Logs provide detailed network traffic information, complementing the overall auditing strategy. While Amazon GuardDuty is a useful security service, it is focused more on threat detection than auditing.
- A. Correct.
CloudTrail provides visibility into API calls and configuration changes across all accounts, making it essential for security auditing.
- B. Correct.
AWS Config checks resource configurations for compliance and tracks configuration changes over time, which is crucial for auditing.
- C. Correct.
CloudFormation drift detection helps identify unexpected changes to infrastructure managed by CloudFormation templates, ensuring infrastructure integrity.
- D. Incorrect.
GuardDuty is a threat detection service and is not primarily used for security auditing. While it enhances security, it is not directly tied to the auditing requirements in this scenario.
- E. Correct.
VPC Flow Logs capture network traffic metadata, which is valuable for auditing and analyzing the traffic patterns in your environment.