SOA-C02 Question 9
Select 3Your organization has enabled AWS CloudTrail to record API activity across all AWS services in your account. Recently, unusual activity was detected in your AWS resources. You have been tasked with investigating API calls related to S3 bucket access to identify potential unauthorized actions. Which of the following steps should you take to analyze the required data?
- A
Use Amazon CloudWatch Logs Insights to query logs from your CloudTrail trail to filter API calls related to S3 buckets.
- B
Download the CloudTrail logs from the S3 bucket where they are stored and analyze them using a text editor.
- C
Enable CloudTrail Insights to identify unusual activity patterns in your S3 bucket-related events.
- D
Use the CloudTrail Event History in the AWS Management Console to filter and review recent S3-related events.
- E
Enable VPC Flow Logs to capture traffic data and analyze S3 bucket API calls.
Show answer and explanation
Correct answers: A, C, D
Explanation
To analyze S3 bucket-related API activity, you can use CloudWatch Logs Insights to query CloudTrail logs, enable CloudTrail Insights for anomaly detection, or use CloudTrail Event History for quick filtering of recent events. These methods provide efficient and scalable ways to investigate API calls. VPC Flow Logs, however, are unrelated to API activity, and manual text-based analysis of downloaded logs is impractical for large datasets.
- A. Correct.
Correct: Amazon CloudWatch Logs Insights allows you to query CloudTrail logs stored in CloudWatch Logs for specific API calls, such as those related to S3 buckets, enabling efficient analysis.
- B. Incorrect.
Incorrect: While you can download the CloudTrail logs and manually analyze them, this approach is inefficient and not recommended for large-scale analysis.
- C. Correct.
Correct: CloudTrail Insights helps detect unusual activity patterns in your API calls, which can be useful for identifying unauthorized or anomalous actions.
- D. Correct.
Correct: CloudTrail Event History in the AWS Management Console provides a quick way to filter and review recent events without needing to query logs.
- E. Incorrect.
Incorrect: VPC Flow Logs capture network traffic data, not API call data, and are not suitable for analyzing S3 bucket API calls.