SCS-C02 Question 87
Select 3An organization has recently migrated its web application to AWS and wants to ensure that any unauthorized API activity is detected and acted upon in real-time. The security team needs a solution that provides near real-time monitoring, integrates with AWS services for alerting, and allows them to analyze suspicious API calls. Which of the following steps should the organization implement to achieve this?
- A
Enable AWS CloudTrail with management and data event logging, and send logs to an S3 bucket for analysis.
- B
Configure Amazon CloudWatch to monitor and trigger alerts for specific CloudTrail API events using CloudWatch Logs and Metrics Filters.
- C
Enable AWS Config Rules to track changes to AWS resources and alert on non-compliant configurations.
- D
Use Amazon GuardDuty to detect suspicious API activity and integrate it with Amazon SNS for real-time notifications.
- E
Set up AWS Shield Advanced to analyze API requests and provide alerts for potential attacks.
Show answer and explanation
Correct answers: A, B, D
Explanation
To address unauthorized API activity, the organization must combine services that offer logging, real-time monitoring, and threat detection. AWS CloudTrail enables comprehensive logging of API calls, CloudWatch allows for real-time alerting based on those logs, and GuardDuty provides advanced threat detection to identify suspicious API activity. Together, these solutions provide a robust monitoring and alerting framework for API security events.
- A. Correct.
Correct. AWS CloudTrail provides a comprehensive log of API activity, which is critical for monitoring and analysis. Storing logs in an S3 bucket allows detailed forensic analysis if needed. However, CloudTrail alone does not provide real-time monitoring or alerting.
- B. Correct.
Correct. Amazon CloudWatch can create alarms based on CloudTrail logs by setting up Metrics Filters for specific API events. This enables near real-time alerting for unauthorized or suspicious activity.
- C. Incorrect.
Incorrect. While AWS Config Rules are useful for monitoring resource configurations, they are not specifically designed for detecting or alerting on API activity in real-time.
- D. Correct.
Correct. Amazon GuardDuty is a managed threat detection service that analyzes CloudTrail logs for suspicious API activity. Integrating with Amazon SNS provides real-time notifications for immediate action.
- E. Incorrect.
Incorrect. AWS Shield Advanced is designed for protection against DDoS attacks and does not provide capabilities for monitoring or alerting on API activity.