SCS-C02 Question 120
Select 3Your organization is using AWS CloudTrail to monitor API activities in your AWS account. You suspect a security incident involving unauthorized access to sensitive resources. Which of the following data points from CloudTrail logs would help you identify a potential security event?
- A
The 'errorCode' field indicating 'AccessDenied'
- B
The 'eventSource' field listing 'ec2.amazonaws.com'
- C
The 'userIdentity.type' field showing 'AssumedRole'
- D
The 'sourceIPAddress' field with an unfamiliar public IP
- E
The 'eventName' field indicating 'DeleteBucket'
Show answer and explanation
Correct answers: A, D, E
Explanation
To identify potential security events in AWS CloudTrail logs, you should look for anomalies or unusual activities such as denied access attempts ('AccessDenied'), access from unfamiliar IP addresses, and actions that could impact critical resources like deleting a bucket. These data points provide evidence of unauthorized or suspicious activity, helping identify and respond to security incidents.
- A. Correct.
The 'errorCode' field with 'AccessDenied' may indicate unauthorized attempts to access resources, which is a strong indicator of a security event.
- B. Incorrect.
While the 'eventSource' field can help identify the AWS service being used, its presence alone (e.g., 'ec2.amazonaws.com') does not necessarily indicate a security event.
- C. Incorrect.
The 'userIdentity.type' field showing 'AssumedRole' is common for applications and IAM roles assuming roles. This alone is not indicative of a security incident.
- D. Correct.
The 'sourceIPAddress' field listing an unfamiliar public IP could indicate access from an unauthorized or suspicious location, which is a potential security concern.
- E. Correct.
The 'eventName' field showing 'DeleteBucket' could indicate a destructive action on critical resources, which may be part of a security incident.