SCS-C02 Question 152
Select 3Your organization uses AWS CloudTrail, Amazon S3, and Amazon CloudWatch Logs to monitor and secure its AWS environment. As part of a security audit, you need to ensure that specific events such as unauthorized API calls and console sign-in failures are logged, and you require real-time notification of these events. Which combination of AWS services and configurations should you use to achieve this?
- A
Enable AWS CloudTrail to log management events and send the logs to an Amazon S3 bucket.
- B
Enable AWS CloudTrail Insights to detect unusual activity patterns in API calls.
- C
Use Amazon CloudWatch Alarms to trigger alerts based on CloudTrail logs stored in S3.
- D
Create a CloudWatch Log Group and configure Metric Filters to detect specific patterns such as unauthorized API calls.
- E
Set up Amazon SNS to send notifications when CloudWatch Alarms are triggered.
Show answer and explanation
Correct answers: A, D, E
Explanation
To detect and respond to specific events like unauthorized API calls and console sign-in failures, you need to leverage CloudTrail for logging, CloudWatch Metric Filters for analyzing log data, and SNS for real-time notifications. CloudTrail ensures that management events are captured, Metric Filters allow you to search for specific patterns in the logs, and SNS provides the mechanism for sending alerts. This combination provides a robust solution for monitoring and securing your AWS environment in real-time.
- A. Correct.
This option is correct because AWS CloudTrail logs management events, which include API activity and management actions. Sending these logs to an S3 bucket ensures they are stored securely and durably.
- B. Incorrect.
While AWS CloudTrail Insights can help detect unusual activity patterns, it is not specifically designed for identifying unauthorized API calls or real-time notification of console sign-in failures.
- C. Incorrect.
Amazon CloudWatch Alarms do not directly analyze CloudTrail logs stored in S3. Instead, Metric Filters on CloudWatch Logs can be used to analyze logs and trigger alarms.
- D. Correct.
This option is correct because CloudWatch Metric Filters can be configured to search for specific patterns (e.g., unauthorized API calls) in log data, enabling the detection of security-related events.
- E. Correct.
This option is correct because Amazon SNS can send notifications (e.g., emails or texts) when CloudWatch Alarms are triggered, ensuring real-time notification of security events.