SCS-C02 Question 465
Select 2An organization has multiple AWS accounts and uses AWS Organizations to manage them. The security team wants to ensure they have centralized visibility into API activities across all accounts and detect potential unauthorized access attempts. Which solution provides the MOST effective and scalable way to meet this requirement?
- A
Enable AWS CloudTrail in each account and deliver logs to a centralized S3 bucket in the management account.
- B
Use Amazon GuardDuty in each account and aggregate findings to the management account.
- C
Configure AWS Config in each account and aggregate configuration data to the management account.
- D
Set up an IAM role in each account to allow cross-account access for security team members.
- E
Enable VPC Flow Logs in each account and store logs centrally for analysis.
Show answer and explanation
Correct answers: A, B
Explanation
To achieve centralized visibility and detect unauthorized access attempts effectively, enabling AWS CloudTrail across all accounts and centralizing logs in an S3 bucket provides a detailed audit trail of API activities. Additionally, Amazon GuardDuty helps detect potential unauthorized access attempts by analyzing various data sources, including CloudTrail logs. Together, these solutions provide a scalable and effective approach to monitoring AWS infrastructure activity across multiple accounts.
- A. Correct.
Enabling AWS CloudTrail in each account and centralizing logs in an S3 bucket allows the organization to monitor API activity comprehensively across all accounts. This is a critical step for centralized visibility and control.
- B. Correct.
Amazon GuardDuty can detect potential unauthorized access attempts by analyzing VPC Flow Logs, DNS logs, and CloudTrail events. Aggregating findings in the management account simplifies monitoring.
- C. Incorrect.
AWS Config provides configuration compliance monitoring but does not directly address API activity visibility or unauthorized access detection. It is not the best fit for this specific requirement.
- D. Incorrect.
Setting up IAM roles for cross-account access is useful for manual investigations or actions but does not provide centralized visibility or automated detection of unauthorized activities.
- E. Incorrect.
VPC Flow Logs provide network activity data but do not directly address API activity visibility. They are not sufficient on their own to detect unauthorized access attempts.