SCS-C02 Question 78
Select 2Your organization uses AWS CloudTrail to monitor API activity and Amazon CloudWatch Logs for centralized log management. A recent security incident investigation requires you to validate whether an Amazon EC2 instance was terminated by an authorized IAM user or a potential attacker. Which of the following steps would you take to validate the event in the logs?
- A
Search the CloudTrail logs for 'TerminateInstances' events and verify the IAM user associated with the event.
- B
Check the CloudWatch Logs for system-level logs from the terminated EC2 instance.
- C
Validate the source IP address and user agent in the CloudTrail event details against known trusted sources.
- D
Inspect the AWS Config logs to identify configuration changes for the terminated EC2 instance.
- E
Examine the S3 bucket access logs to identify if the terminated EC2 instance accessed sensitive data before termination.
Show answer and explanation
Correct answers: A, C
Explanation
To validate the termination of an EC2 instance, you need to rely on AWS CloudTrail, which records API activity, including 'TerminateInstances' events. Searching for this event type allows you to identify the IAM user or role responsible. Additionally, validating the source IP address and user agent for the event helps confirm if the request originated from a trusted source or a potential attacker. Other options, such as AWS Config or S3 bucket logs, do not directly provide the required information for validating the termination event.
- A. Correct.
Correct: CloudTrail logs record all API activity in your AWS environment, including 'TerminateInstances' events. Searching for this event type lets you identify the IAM user or role responsible for the termination.
- B. Incorrect.
Incorrect: While CloudWatch Logs can provide detailed metrics and logs, it does not directly store CloudTrail events or termination details. This option is not relevant for validating who terminated the instance.
- C. Correct.
Correct: Validating the source IP address and user agent in the CloudTrail event details helps confirm whether the request originated from a trusted source or a potential attacker.
- D. Incorrect.
Incorrect: AWS Config tracks resource configurations and changes but does not log API activity. It cannot be used to validate who terminated the EC2 instance.
- E. Incorrect.
Incorrect: While S3 bucket access logs might provide insights into data access, they are unrelated to validating the termination event for the EC2 instance.