SCS-C02 Question 175
Single answerAn organization has enabled AWS CloudTrail to monitor API activity and detect unusual behavior. They want to identify operational anomalies like spikes in API call volumes or unusual activity patterns. Which AWS service and feature combination should they use to efficiently analyze this data?
- A
AWS CloudWatch Logs Insights to query CloudTrail logs for anomalies.
- B
AWS CloudTrail Insights to automatically detect unusual API call patterns.
- C
AWS Security Hub Insights to consolidate findings from CloudTrail logs.
- D
AWS Config to evaluate changes in resource configurations.
Show answer and explanation
Correct answer: B
Explanation
AWS CloudTrail Insights is the correct choice because it is an advanced feature of CloudTrail that automatically detects unusual activity patterns such as spikes in API call volumes or changes in usage behavior. This makes it the most efficient and automated option for identifying operational anomalies in API activity.
- A. Incorrect.
AWS CloudWatch Logs Insights allows you to perform custom queries on logs, but it does not automatically detect anomalies in API activity. Instead, it is better suited for ad-hoc log analysis.
- B. Correct.
AWS CloudTrail Insights is specifically designed to detect unusual operational activity, such as spikes in API call volumes or anomalous patterns in API usage. It is the most efficient and automated option for this scenario.
- C. Incorrect.
AWS Security Hub Insights helps consolidate security findings across AWS services, but it does not focus on operational anomalies in API activity detected by CloudTrail.
- D. Incorrect.
AWS Config evaluates changes in resource configurations for compliance and drift but is not used for analyzing API logs or detecting anomalies in API call patterns.