SCS-C02 Question 69
Select 2An organization is experiencing unexpected API calls being made to their AWS environment, which are coming from an unknown external IP address. You are tasked to investigate and determine the root cause. Which of the following steps would you take to perform a root cause analysis? (Select TWO)
- A
Analyze AWS CloudTrail logs to identify the source of the API calls and associated credentials.
- B
Terminate the EC2 instance that is suspected of being compromised.
- C
Use AWS Config to review changes made to IAM policies and roles.
- D
Enable VPC Flow Logs to capture detailed information about the traffic from the suspicious IP address.
- E
Generate an IAM Access Advisor report to identify overly permissive access rights.
Show answer and explanation
Correct answers: A, C
Explanation
To perform root cause analysis for unexpected API calls, it is crucial to investigate the source of the API requests and any changes made to IAM resources. CloudTrail logs provide visibility into API activity, while AWS Config enables you to track changes to IAM policies and roles, which could reveal unauthorized modifications. These steps are critical for identifying and addressing the root cause of the issue.
- A. Correct.
CloudTrail logs provide detailed information about API calls, including the source, time, and user/role making the request. This is essential for identifying the root cause of the issue.
- B. Incorrect.
While terminating a potentially compromised instance might mitigate the immediate threat, it does not help in identifying the root cause of the unknown API calls.
- C. Correct.
AWS Config tracks changes to resources, including IAM policies and roles. Reviewing these changes can help identify if any roles or policies were modified maliciously, aiding in root cause analysis.
- D. Incorrect.
VPC Flow Logs are useful for monitoring network traffic but do not provide information about API calls or IAM actions, which is crucial for this scenario.
- E. Incorrect.
IAM Access Advisor helps in identifying unused permissions but is not directly relevant for determining the source of suspicious API calls.