SCS-C02 Question 79
Select 3Your company is investigating a potential security incident involving unauthorized API calls to your AWS environment. The security team wants to validate whether the suspicious activities align with actual user actions. Which of the following options can help achieve this goal effectively?
- A
Analyze AWS CloudTrail logs to review API call history and associated user identities.
- B
Enable Amazon GuardDuty to detect suspicious activities and compare them with the reported API calls.
- C
Search AWS CloudWatch Logs for specific error codes or anomalies related to the API calls.
- D
Use AWS Config to verify if any configuration changes align with the suspicious API calls.
- E
Inspect VPC Flow Logs to directly validate user intent behind the API calls.
Show answer and explanation
Correct answers: A, C, D
Explanation
To validate suspicious API calls, analyzing AWS CloudTrail logs is essential since they provide a comprehensive history of API activity. CloudWatch Logs can be used to identify related anomalies or error codes, and AWS Config can provide valuable context by correlating configuration changes with the reported API calls. GuardDuty and VPC Flow Logs, while useful for other purposes, do not directly assist in validating API calls or user actions in this scenario.
- A. Correct.
AWS CloudTrail logs provide a detailed history of API calls made within your AWS account, including the identity of the caller, which is critical for validating whether the reported activities match actual user actions.
- B. Incorrect.
Amazon GuardDuty is a threat detection service that provides alerts for suspicious behavior, but it does not directly validate API calls or provide specifics about user actions.
- C. Correct.
AWS CloudWatch Logs can help identify anomalies or error codes related to the suspicious API calls, providing additional context for validation.
- D. Correct.
AWS Config tracks configuration changes in your AWS environment, which can be cross-referenced with the suspicious API activity to determine if they are related.
- E. Incorrect.
VPC Flow Logs capture network traffic metadata but do not provide insight into API calls or user actions, making them unsuitable for this specific purpose.