SCS-C02 Question 133
Select 3An organization has enabled AWS CloudTrail for auditing purposes and configured it to deliver logs to an S3 bucket. However, they notice that their S3 bucket is quickly filling up with CloudTrail logs, making it difficult to manage storage costs and analyze logs efficiently. Which of the following actions can the organization take to optimize their logging configuration while retaining necessary security information?
- A
Enable CloudTrail log file validation to ensure log integrity.
- B
Configure CloudTrail to log only specific events by creating an event selector.
- C
Set the S3 bucket lifecycle policy to automatically delete old logs after a specified period.
- D
Increase the verbosity of CloudTrail logs to capture all API events in detail.
- E
Enable logging to an Amazon CloudWatch Logs group and create metric filters for critical events.
Show answer and explanation
Correct answers: B, C, E
Explanation
To address the issue of excessive log storage, the organization can optimize their CloudTrail logging configuration in several ways. By using event selectors, they can reduce the volume of logs by targeting only specific events. Configuring an S3 bucket lifecycle policy ensures efficient storage management by automatically deleting outdated logs. Additionally, integrating with CloudWatch Logs allows for more advanced filtering and monitoring, reducing reliance on S3 for log analysis. These actions maintain security visibility while addressing the concerns of storage and manageability.
- A. Incorrect.
While enabling log file validation ensures log integrity, it does not help reduce log verbosity or optimize storage usage. This option is unrelated to the problem described.
- B. Correct.
Configuring CloudTrail to log only specific events using an event selector can significantly reduce the number of logs generated, optimizing storage usage and making logs more targeted for analysis.
- C. Correct.
Setting an S3 bucket lifecycle policy to delete old logs after a specified period helps manage storage costs by automatically cleaning up outdated logs.
- D. Incorrect.
Increasing verbosity will capture more detailed logs, but this will exacerbate the problem by increasing the volume of logs and storage usage.
- E. Correct.
Logging to Amazon CloudWatch Logs and creating metric filters for critical events can help focus on important events without relying solely on S3 for log analysis, thereby optimizing log management.