SCS-C02 Question 83
Select 4An organization has recently been alerted about unauthorized access to one of their S3 buckets. They want to identify the source of the access and ensure that similar incidents are prevented in the future. Which of the following steps should the organization take to achieve this?
- A
Enable S3 server access logging to track bucket-level access requests.
- B
Use AWS CloudTrail to log and monitor API activity for the S3 bucket.
- C
Enable Amazon GuardDuty to monitor for malicious activity related to the S3 bucket.
- D
Set up an AWS Config rule to enforce encryption of the S3 bucket.
- E
Review and update the S3 bucket policy to restrict public access.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To identify the source of unauthorized access and prevent future incidents, the organization should enable logging (via S3 server access logging and CloudTrail) to track and audit access activities. Additionally, enabling GuardDuty helps detect malicious activities, and updating the bucket policy ensures that public access is restricted. Enforcing encryption, while important, does not directly address the issue of unauthorized access in this scenario.
- A. Correct.
Enabling S3 server access logging provides detailed records of requests made to the bucket, including the source IP address, which can help identify the source of unauthorized access.
- B. Correct.
CloudTrail logs API activity, including actions taken on the S3 bucket, which is crucial for identifying and auditing unauthorized activity.
- C. Correct.
Amazon GuardDuty can detect suspicious activities, such as unusual access patterns or malicious IP addresses interacting with the bucket.
- D. Incorrect.
While enforcing encryption is a good security practice, it does not directly help in identifying or preventing unauthorized access.
- E. Correct.
Restricting public access through the bucket policy minimizes the risk of unauthorized access, helping prevent future incidents.