SCS-C02 Question 131
Select 2An organization is investigating unusual activity in their AWS environment. They suspect unauthorized API calls and need to identify the root cause. Which AWS services or features should be utilized to provide the necessary logging and monitoring data to support this investigation? (Choose TWO)
- A
AWS CloudTrail
- B
Amazon GuardDuty
- C
VPC Flow Logs
- D
AWS Trusted Advisor
- E
Amazon Inspector
Show answer and explanation
Correct answers: A, C
Explanation
To investigate unauthorized API calls and identify the root cause, the organization should use AWS CloudTrail for detailed API activity logs and VPC Flow Logs for network traffic monitoring. These two services together provide the necessary data to detect and analyze unusual activity. Other options, such as Amazon GuardDuty or Inspector, are not directly designed for providing raw logging data required for such investigations.
- A. Correct.
AWS CloudTrail provides a detailed record of all API calls made within an AWS account, including the identity of the caller, the time of the call, and the actions taken, making it essential for investigating unauthorized API activity.
- B. Incorrect.
Amazon GuardDuty is a threat detection service that analyzes data for anomalies and potential threats, but it does not provide raw logging data for API activity or network traffic, which is necessary for this investigation.
- C. Correct.
VPC Flow Logs provide detailed information about the network traffic going to and from network interfaces in your VPC. This data can help identify unusual activity at the network level, complementing API logs.
- D. Incorrect.
AWS Trusted Advisor provides recommendations to optimize resources, improve security, and reduce costs, but it does not provide logging or monitoring data for investigating unauthorized activity.
- E. Incorrect.
Amazon Inspector is a vulnerability management service that helps identify security vulnerabilities in your resources, but it does not provide logging or monitoring data for API calls or network traffic.