SCS-C02 Question 80
Select 3An organization has enabled AWS CloudTrail to log API activity across its accounts. As part of a security audit, the Security team needs to validate if a specific 'DeleteBucket' event occurred and whether it was authorized or unauthorized. Which of the following steps should the Security team perform to achieve this?
- A
Search the CloudTrail logs for the 'DeleteBucket' event and check the 'eventSource' and 'eventName' fields.
- B
Examine the 'errorCode' field in the CloudTrail log entry to verify if the 'DeleteBucket' action was successful or failed.
- C
Use Amazon Macie to identify sensitive data in the bucket before validating the 'DeleteBucket' event.
- D
Check the 'userIdentity' field in the CloudTrail log entry to determine which IAM principal initiated the 'DeleteBucket' action.
- E
Review the S3 server access logs to identify the IP address of the client that initiated the 'DeleteBucket' request.
Show answer and explanation
Correct answers: A, B, D
Explanation
To validate a 'DeleteBucket' event, the Security team should analyze the relevant CloudTrail log entries. Key fields such as 'eventSource' and 'eventName' help identify the event, while 'errorCode' determines its success or failure. Additionally, the 'userIdentity' field reveals who initiated the action. These steps collectively ensure comprehensive validation of the event. Tools like Amazon Macie or S3 server access logs are not suitable for this specific use case.
- A. Correct.
Correct: The 'eventSource' and 'eventName' fields in CloudTrail logs are key to identifying the specific API event, such as 'DeleteBucket'. This is the first step in validating the event.
- B. Correct.
Correct: The 'errorCode' field in the CloudTrail log entry provides information on whether the action was successful or unauthorized. This is critical for validation.
- C. Incorrect.
Incorrect: Amazon Macie is used for data classification and analysis, not for validating API event logs like 'DeleteBucket'.
- D. Correct.
Correct: The 'userIdentity' field in the CloudTrail log entry contains details about the IAM principal (user or role) that performed the action. This helps track who initiated the 'DeleteBucket' event.
- E. Incorrect.
Incorrect: S3 server access logs capture bucket-level access events, but they do not provide detailed validation or authorization information for actions like 'DeleteBucket'. CloudTrail is the correct tool for this purpose.