DOP-C02 Question 402
Select 4Your company has a multi-account AWS environment managed through AWS Organizations. The security team has identified the need to ensure that all accounts are compliant with security best practices, specifically by auditing changes to resource configurations, tracking API calls, and monitoring network traffic. They also need to identify and resolve any configuration drifts in CloudFormation stacks. Which combination of AWS services and features should you implement to meet these requirements?
- A
AWS CloudTrail for tracking API calls across all accounts
- B
AWS Config for monitoring resource configurations and compliance
- C
VPC Flow Logs for monitoring network traffic
- D
Amazon Inspector for auditing EC2 instances for vulnerabilities
- E
CloudFormation drift detection for identifying stack configuration changes
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To meet the requirements for auditing changes to configurations, tracking API calls, monitoring network traffic, and identifying configuration drifts, multiple AWS services are needed. AWS CloudTrail provides the audit trail for API calls, AWS Config monitors resource configurations, VPC Flow Logs tracks network traffic, and CloudFormation drift detection identifies stack configuration changes. Together, these services ensure comprehensive security auditing and compliance.
- A. Correct.
AWS CloudTrail is essential for tracking API calls across all accounts, which provides a detailed audit trail of actions taken on AWS services. This directly addresses the requirement of auditing API calls.
- B. Correct.
AWS Config is used to assess, audit, and evaluate the configurations of your AWS resources. It ensures compliance with security best practices and is critical for monitoring configuration changes.
- C. Correct.
VPC Flow Logs capture information about the IP traffic going to and from network interfaces within your VPC, which satisfies the requirement of monitoring network traffic.
- D. Incorrect.
Amazon Inspector is a vulnerability assessment service for EC2 instances and container images but does not address the specific needs mentioned for configuration or security auditing in this scenario.
- E. Correct.
CloudFormation drift detection helps identify configuration changes to CloudFormation-managed resources, ensuring stack compliance. This satisfies the requirement of identifying and resolving stack configuration drifts.