SCS-C02 Question 177
Select 3An organization has enabled AWS CloudTrail logging to monitor API activity across its AWS account. The security team needs to analyze the logs to identify unauthorized access attempts and actions performed by specific IAM users. Which key components of a CloudTrail log file should the security team focus on to retrieve this information?
- A
eventSource
- B
userIdentity
- C
eventTime
- D
responseElements
- E
errorCode
Show answer and explanation
Correct answers: A, B, E
Explanation
The 'userIdentity' field provides details about the user or role initiating the action, while the 'errorCode' field helps identify unauthorized access attempts. Together, they allow the security team to pinpoint suspicious activities and users. Although 'eventTime' and 'eventSource' provide context, they are not as directly relevant to identifying unauthorized access or specific IAM users.
- A. Correct.
The 'eventSource' field indicates the service that generated the event, such as 's3.amazonaws.com' or 'ec2.amazonaws.com'. While useful for identifying the service, it doesn't directly identify unauthorized access or specific users.
- B. Correct.
The 'userIdentity' field contains information about the IAM user or role that initiated the API call. This is critical for identifying actions performed by specific users.
- C. Incorrect.
The 'eventTime' field specifies when the event occurred, which is useful for timeline analysis but does not directly indicate unauthorized access or user actions.
- D. Incorrect.
The 'responseElements' field contains the response returned by the AWS service, such as success or failure of the API call. However, this does not directly identify unauthorized access or user-specific details.
- E. Correct.
The 'errorCode' field captures errors generated by the API call, such as 'AccessDenied'. This is invaluable for detecting unauthorized access attempts.