Security Engineering on AWS Certification Security Engineering on AWS Certification Security Monitoring & Logging 1 — Questions and Answers
Question 1: Which AWS service provides a complete history of API calls made within your account, including calls from the AWS Management Console, SDKs, and CLI?
- AWS CloudTrail (Correct answer)
- Amazon CloudWatch
- AWS Config
- Amazon GuardDuty
Correct answer: AWS CloudTrail
AWS CloudTrail records all API activity and delivers log files to an S3 bucket for auditing and compliance.
Question 2: When configuring CloudTrail for a multi-account AWS Organization, what is the best practice for storing logs?
- Store logs in each individual account's S3 bucket
- Use an organization trail to aggregate logs into a centralized S3 bucket in the management account (Correct answer)
- Enable CloudTrail only in the management account
- Store logs in an EC2 instance in each region
Correct answer: Use an organization trail to aggregate logs into a centralized S3 bucket in the management account
An organization trail centralizes logs from all member accounts into a single S3 bucket, simplifying audit and security monitoring.
Question 3: Which CloudTrail feature allows you to validate that log files have not been tampered with after delivery?
- Log file encryption
- Log file validation using digest files (Correct answer)
- S3 versioning
- CloudWatch Logs integration
Correct answer: Log file validation using digest files
CloudTrail log file validation creates SHA-256 digest files that you can use to verify log integrity.
Question 4: An engineer wants to receive real-time alerts when a root account login occurs. Which combination of services should they use?
- CloudTrail + S3 event notifications
- CloudTrail + CloudWatch Logs + CloudWatch Alarms + SNS (Correct answer)
- AWS Config + Lambda
- GuardDuty + Security Hub
Correct answer: CloudTrail + CloudWatch Logs + CloudWatch Alarms + SNS
CloudTrail streams events to CloudWatch Logs, where a metric filter detects root login events and triggers a CloudWatch Alarm that notifies via SNS.
Question 5: What is the purpose of AWS Config in a security monitoring strategy?
- To monitor network traffic for threats
- To record configuration changes to AWS resources and evaluate compliance against rules (Correct answer)
- To scan EC2 instances for vulnerabilities
- To aggregate security findings across services
Correct answer: To record configuration changes to AWS resources and evaluate compliance against rules
AWS Config continuously records resource configurations and can evaluate them against desired-state rules for compliance.
Question 6: Which AWS service uses machine learning to analyze CloudTrail events and other data sources to detect unexpected and potentially unauthorized activity in your AWS environment?
- Amazon Inspector
- AWS Security Hub
- Amazon GuardDuty (Correct answer)
- AWS Trusted Advisor
Correct answer: Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity using ML on CloudTrail, VPC Flow Logs, and DNS logs.
Security Engineering on AWS Certification Security Engineering on AWS Certification Security Monitoring & Logging 1
Which AWS service provides a complete history of API calls made within your account, including calls from the AWS Management Console, SDKs, and CLI?