Security Engineering on AWS Certification Security Engineering on AWS Certification Security Monitoring & Logging

Question 1

Which AWS service provides a complete history of API calls made within your account, including calls from the AWS Management Console, SDKs, and CLI?

Accepted Answer

AWS CloudTrail

Answer

AWS CloudTrail records all API activity and delivers log files to an S3 bucket for auditing and compliance.

Question 2

When configuring CloudTrail for a multi-account AWS Organization, what is the best practice for storing logs?

Accepted Answer

Use an organization trail to aggregate logs into a centralized S3 bucket in the management account

Answer

An organization trail centralizes logs from all member accounts into a single S3 bucket, simplifying audit and security monitoring.

Question 3

Which CloudTrail feature allows you to validate that log files have not been tampered with after delivery?

Accepted Answer

Log file validation using digest files

Answer

CloudTrail log file validation creates SHA-256 digest files that you can use to verify log integrity.

Question 4

An engineer wants to receive real-time alerts when a root account login occurs. Which combination of services should they use?

Accepted Answer

CloudTrail + CloudWatch Logs + CloudWatch Alarms + SNS

Answer

CloudTrail streams events to CloudWatch Logs, where a metric filter detects root login events and triggers a CloudWatch Alarm that notifies via SNS.

Question 5

What is the purpose of AWS Config in a security monitoring strategy?

Accepted Answer

To record configuration changes to AWS resources and evaluate compliance against rules

Answer

AWS Config continuously records resource configurations and can evaluate them against desired-state rules for compliance.

Security Engineering on AWS Certification Practice Test