SCS-C02 Question 77
Select 4Your organization has enabled AWS CloudTrail to monitor API activity in your AWS environment. A security incident has been reported involving unauthorized access to an S3 bucket. As part of the investigation, you are tasked with validating the event by analyzing the logs. Which steps should you take to validate the unauthorized access event and its origin?
- A
Search the CloudTrail logs for entries related to S3 bucket access and review the eventName field for actions like GetObject or PutObject.
- B
Filter CloudTrail logs by the sourceIPAddress field to identify the IP address associated with the unauthorized access.
- C
Check the AWS Config logs to validate the configuration changes made to the S3 bucket during the incident.
- D
Verify the user identity in the CloudTrail logs by reviewing the userIdentity field to confirm if it matches a known IAM role or user.
- E
Inspect the S3 bucket access logs (if enabled) to cross-check access patterns with CloudTrail logs for consistency.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To validate an unauthorized access event, it is crucial to analyze logs that provide details about the API calls, the origin of the request, and the identity of the entity making the request. CloudTrail logs are the primary source for this data, allowing you to investigate fields such as eventName, sourceIPAddress, and userIdentity. Additionally, S3 bucket access logs (if enabled) can complement this analysis by providing further insights into access patterns. AWS Config logs, however, are focused on resource configuration changes and do not provide the necessary details for validating API activity.
- A. Correct.
Correct. The eventName field in CloudTrail logs will indicate the specific API action (e.g., GetObject or PutObject) performed on the S3 bucket, helping you identify unauthorized access events.
- B. Correct.
Correct. The sourceIPAddress field in CloudTrail logs can help you trace the origin of the request, enabling you to validate if the access came from a trusted or unauthorized source.
- C. Incorrect.
Incorrect. AWS Config logs track configuration changes to AWS resources, but they do not provide detailed logs of API activity or access patterns needed to validate the incident.
- D. Correct.
Correct. The userIdentity field in CloudTrail logs contains information about the IAM user, role, or entity making the request, helping you confirm whether it matches a legitimate identity.
- E. Correct.
Correct. S3 bucket access logs (if enabled) provide detailed information about access requests to the bucket, which can be cross-referenced with CloudTrail logs for a more complete picture of the incident.