SCS-C02 Question 154
Single answerYour organization has recently experienced a security incident involving unauthorized changes to IAM policies. To perform an in-depth investigation and determine who made the changes, you need to analyze logs that provide details about API calls and modifications to AWS resources. Which AWS service should you use to retrieve this information?
- A
Amazon CloudWatch Logs
- B
AWS CloudTrail
- C
Amazon VPC Flow Logs
- D
Amazon Route 53 DNS Query Logs
Show answer and explanation
Correct answer: B
Explanation
AWS CloudTrail is the correct choice because it provides detailed logging of all API calls made to your AWS account, including those related to IAM policy changes. This allows security teams to trace unauthorized actions and understand who made specific changes to AWS resources, making it an essential tool for incident investigations.
- A. Incorrect.
Amazon CloudWatch Logs is used for collecting and monitoring log data from various sources, but it does not provide a detailed history of API calls or resource changes.
- B. Correct.
AWS CloudTrail specifically records API calls made within your AWS account, including information about who made the changes, what changes were made, and when they were made. This makes it the appropriate service for investigating unauthorized IAM policy changes.
- C. Incorrect.
Amazon VPC Flow Logs capture network traffic metadata for a VPC, which is useful for analyzing network activity but not for tracking API calls or resource modifications.
- D. Incorrect.
Amazon Route 53 DNS Query Logs provide information about DNS queries routed through Amazon Route 53, but they do not log API calls or changes to AWS resources.