SCS-C02 Question 179
Single answerAn organization is using AWS CloudTrail to monitor API activity in their AWS environment. A security engineer is tasked with analyzing a specific CloudTrail log file to determine the source of an unauthorized API call. Which of the following log fields in the CloudTrail event is MOST useful in identifying the source of the API call?
- A
eventSource
- B
awsRegion
- C
sourceIPAddress
- D
userAgent
Show answer and explanation
Correct answer: C
Explanation
To identify the source of an unauthorized API call, the 'sourceIPAddress' field is the most critical. It provides the IP address from which the API call originated, allowing the security team to trace the source of the activity. While other fields in the CloudTrail log provide additional context, such as the AWS service used ('eventSource') or the application making the call ('userAgent'), they do not specifically identify the origin of the request as effectively as 'sourceIPAddress'.
- A. Incorrect.
The 'eventSource' field identifies which AWS service generated the event. While useful for understanding the service used, it does not specifically identify the source of the API call.
- B. Incorrect.
The 'awsRegion' field identifies the AWS region where the API call was made, but it does not pinpoint the origin of the call.
- C. Correct.
The 'sourceIPAddress' field captures the IP address from which the API call was made, making it the most relevant field for identifying the source of the call.
- D. Incorrect.
The 'userAgent' field provides details about the application or tool used to make the API call, but it does not directly identify the source of the call like the IP address does.