SCS-C02 Question 467
Select 3Your organization requires real-time visibility into API calls made to the AWS environment for compliance and security purposes. Additionally, the team needs to ensure that all logs are securely stored and cannot be tampered with. Which combination of services or features should you use to achieve this?
- A
Enable AWS CloudTrail and configure it to log all management and data events
- B
Use Amazon CloudWatch Logs to monitor and analyze log data from CloudTrail
- C
Enable AWS Config to track and audit AWS resource configurations
- D
Configure an Amazon S3 bucket for CloudTrail logs with default permissions
- E
Use Amazon S3 Object Lock to apply a write-once-read-many (WORM) policy to CloudTrail logs
Show answer and explanation
Correct answers: A, B, E
Explanation
To achieve real-time visibility and ensure the integrity of logs, you need to enable AWS CloudTrail to log API activity, use Amazon CloudWatch Logs for monitoring and analysis, and configure Amazon S3 Object Lock to prevent log tampering. AWS Config, while useful for tracking resource configurations, is not relevant for API activity logging in this scenario. Similarly, default S3 permissions do not provide the required level of security for logs.
- A. Correct.
This is correct because AWS CloudTrail provides visibility into API activity within your AWS environment and can be configured to log management and data events.
- B. Correct.
This is correct because Amazon CloudWatch Logs can be used to monitor and analyze log data from CloudTrail, enabling real-time visibility into activity.
- C. Incorrect.
This is incorrect because AWS Config is used to track and audit resource configurations, not API activity or secure log storage.
- D. Incorrect.
This is incorrect because an Amazon S3 bucket with default permissions does not ensure log integrity or protection from tampering.
- E. Correct.
This is correct because Amazon S3 Object Lock applies a WORM policy to CloudTrail logs, ensuring they cannot be deleted or modified.