SOA-C02 Question 10
Select 2Your company uses AWS CloudTrail to monitor API activity and Amazon CloudWatch Logs to centralize log files. Recently, the security team requested to identify any unauthorized API calls made to your AWS environment in the last 7 days. You need to provide a detailed report of these events for their analysis. Which of the following steps should you take to achieve this?
- A
Use the AWS CloudTrail console to filter events by 'UnauthorizedOperation' or 'AccessDenied' in the past 7 days, and download the results.
- B
Run a query in CloudWatch Logs Insights on the CloudTrail logs group using a filter for error codes like 'UnauthorizedOperation' or 'AccessDenied', and export the results.
- C
Enable Amazon GuardDuty to detect unauthorized API calls and use the findings to generate the report.
- D
Use the AWS Config console to review all non-compliant resources and export the findings as the report.
- E
Download the S3 bucket storing CloudTrail logs and manually search for 'UnauthorizedOperation' or 'AccessDenied' events using a text editor.
Show answer and explanation
Correct answers: A, B
Explanation
To identify unauthorized API calls in the past 7 days, you can either use the AWS CloudTrail console to filter for events with error codes like 'UnauthorizedOperation' or 'AccessDenied', or utilize CloudWatch Logs Insights to query the corresponding CloudTrail logs group with similar filters. These methods are efficient, purpose-built for log analysis, and capable of generating the required report. GuardDuty and AWS Config are not suitable for this scenario, and manually searching through logs is not practical.
- A. Correct.
This is correct. The AWS CloudTrail console allows filtering events by specific error codes like 'UnauthorizedOperation' or 'AccessDenied', making it a direct way to identify unauthorized API calls.
- B. Correct.
This is correct. CloudWatch Logs Insights can query the CloudTrail logs group for specific error codes, providing a powerful and flexible method to identify unauthorized API calls in a specified time frame.
- C. Incorrect.
This is incorrect. While Amazon GuardDuty can detect unauthorized API calls, it is primarily designed for continuous threat detection and anomaly detection, not for generating detailed custom reports based on historical logs.
- D. Incorrect.
This is incorrect. AWS Config is used to track compliance and resource configuration changes. It does not provide detailed insights into API activity or unauthorized calls.
- E. Incorrect.
This is incorrect. While downloading and manually searching CloudTrail logs is possible, it is inefficient and error-prone compared to using CloudTrail filters or CloudWatch Logs Insights queries.