SCS-C02 Question 178
Select 2You are a security engineer tasked with analyzing unexpected API activity in your AWS environment. You decide to review AWS CloudTrail logs to identify the cause. Which of the following components in a CloudTrail log file would help you determine the AWS service that was affected and the specific action performed?
- A
eventSource
- B
eventName
- C
awsRegion
- D
userAgent
- E
requestParameters
Show answer and explanation
Correct answers: A, B
Explanation
To determine the AWS service that was affected and the specific action performed, the 'eventSource' and 'eventName' fields in a CloudTrail log are essential. 'eventSource' specifies the service (e.g., s3.amazonaws.com), while 'eventName' specifies the action (e.g., PutObject). Together, these fields provide the necessary information to identify the root cause of unexpected API activity.
- A. Correct.
The 'eventSource' field specifies the AWS service that generated the event. This is crucial for identifying which service was affected.
- B. Correct.
The 'eventName' field indicates the specific API action that was performed, helping to determine what operation occurred.
- C. Incorrect.
The 'awsRegion' field specifies the region where the event took place, but it does not directly identify the AWS service or action.
- D. Incorrect.
The 'userAgent' field identifies the client making the request (e.g., AWS SDK, CLI), but it does not provide information about the service or action.
- E. Incorrect.
The 'requestParameters' field contains the parameters sent with the API request, but it does not directly indicate the service or action performed.