SCS-C02 Question 149
Single answerYour organization is conducting a forensic investigation to analyze a potential data breach in an S3 bucket. As part of the investigation, you need to identify and review all access requests to the S3 bucket, including details such as the source IP address, the time of the requests, and the actions performed. Which AWS service and feature combination would provide the most appropriate data for this purpose?
- A
AWS CloudTrail with S3 data events enabled
- B
Amazon S3 Server Access Logging
- C
Amazon CloudWatch Logs with VPC Flow Logs enabled
- D
AWS Config with an S3 configuration recorder enabled
Show answer and explanation
Correct answer: A
Explanation
To conduct an effective forensic investigation into an S3 data breach, detailed access logs including API activity, source IPs, and timestamps are required. AWS CloudTrail with S3 data events enabled is specifically designed to provide this level of detail for S3 buckets, making it the best choice. While other services like S3 Server Access Logging or AWS Config provide some level of visibility, they lack the granularity and specific information needed for this scenario.
- A. Correct.
AWS CloudTrail with S3 data events enabled provides detailed logs of API activity on S3 buckets, including object-level operations, the source IP address, and the time of access. This makes it the most suitable for identifying access requests during a forensic investigation.
- B. Incorrect.
Amazon S3 Server Access Logging provides logs of access requests to S3 buckets but lacks details such as the specific API operations performed, making it less useful for forensic investigations.
- C. Incorrect.
Amazon CloudWatch Logs with VPC Flow Logs enabled captures network traffic metadata, such as source and destination IPs, but does not provide S3-specific API activity details necessary for this investigation.
- D. Incorrect.
AWS Config with an S3 configuration recorder tracks changes to S3 bucket configurations but does not log data access events or API operations, making it unsuitable for this use case.