SCS-C02 Question 118
Select 3Your organization has recently enabled AWS CloudTrail to monitor API activity in your AWS environment. During a routine security review, you want to identify potential unauthorized access attempts or changes to critical resources. Which of the following data points from CloudTrail logs are most relevant for detecting suspicious security events?
- A
The 'eventName' field indicating actions performed on resources.
- B
The 'sourceIPAddress' field showing the IP address of the requester.
- C
The 'responseElements' field showing detailed outputs of the API calls.
- D
The 'userIdentity' field containing information about who made the request.
- E
The 'awsRegion' field indicating the region where the API call occurred.
Show answer and explanation
Correct answers: A, B, D
Explanation
When analyzing CloudTrail logs for potential security events, it is essential to focus on fields that provide actionable insights into who accessed the system ('userIdentity'), where the request came from ('sourceIPAddress'), and what actions were performed ('eventName'). These data points are fundamental for detecting unauthorized access attempts or identifying suspicious activity. While other fields like 'responseElements' and 'awsRegion' provide context, they are less critical for directly identifying security events.
- A. Correct.
The 'eventName' field is critical for identifying what actions were performed, such as 'DeleteBucket' or 'PutObject', which could indicate unauthorized or suspicious activity.
- B. Correct.
The 'sourceIPAddress' field helps trace where the request originated from, which can indicate suspicious access from unexpected IPs or geolocations.
- C. Incorrect.
While the 'responseElements' field can provide useful context, it is less critical for identifying security events as it primarily contains result data rather than access or identity details.
- D. Correct.
The 'userIdentity' field is essential for determining who initiated the request, such as an IAM user, role, or root account, which is critical for identifying unauthorized access.
- E. Incorrect.
The 'awsRegion' field provides information about the region where the API call occurred but is typically less relevant for identifying security events unless it is part of a broader anomaly detection strategy.