SCS-C02 Question 345
Single answerYour organization uses AWS Systems Manager Session Manager for secure shell access to Amazon EC2 instances. A new compliance requirement mandates that all Session Manager sessions must be logged for audit purposes, and the logs should include both session activity and commands executed. What is the most secure way to meet this requirement?
- A
Enable Session Manager logging to an Amazon S3 bucket with server-side encryption enabled.
- B
Configure Session Manager to log session activity and commands to AWS CloudTrail.
- C
Set up Session Manager to send session activity logs to Amazon CloudWatch Logs with encryption at rest enabled.
- D
Enable detailed monitoring in EC2 and use CloudTrail to capture session logs.
Show answer and explanation
Correct answer: C
Explanation
To meet the requirement for logging both session activity and commands executed securely, Amazon CloudWatch Logs is the best choice. It integrates with Session Manager to provide detailed session activity and command data. Additionally, enabling encryption at rest ensures the logs are protected, aligning with compliance and security requirements.
- A. Incorrect.
This option logs session activity to an Amazon S3 bucket, but it does not natively support capturing command execution details. Additionally, relying on S3 alone without encryption or proper IAM policies may not meet the 'most secure' requirement.
- B. Incorrect.
AWS CloudTrail provides event logs for API actions but does not capture detailed session activity or the exact commands executed during a Session Manager session.
- C. Correct.
This option is correct because Amazon CloudWatch Logs can capture both session activity and commands, and encryption at rest ensures compliance with security best practices.
- D. Incorrect.
Enabling detailed monitoring in EC2 does not provide session activity logs or command-level details. CloudTrail is not suitable for capturing detailed session data.