Exams / CLF-C02 / Monitoring, logging and auditing / Question 2
CLF-C02 practice question: Monitoring, logging and auditing (2 of 2)
Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A company's auditors require a record of all API activity in its AWS account to be kept for several years. The team can already see recent activity in the AWS CloudTrail event history. What should it do to meet the requirement?
Choose one answer.
- AA. Create a CloudTrail trail that delivers log files to an Amazon S3 bucket
- BB. Do nothing, because event history keeps all events for the life of the account
- CC. Turn on Amazon GuardDuty to store the API history
- DD. Enable an AWS Trusted Advisor check for API activity
Show the answer and explanation
Answer: A
- A. Right: Correct. Event history covers only the last 90 days of management events, so a trail is needed to keep a longer, ongoing record in S3.
- B. Wrong: CloudTrail event history shows only the past 90 days of management events in each Region.
- C. Wrong: GuardDuty analyses logs to detect threats. It is not an archive of API activity for auditors.
- D. Wrong: Trusted Advisor checks resources against best practices. It does not record or store API calls.
Explanation
Every account has CloudTrail event history, a searchable record of the last 90 days of management events. For longer retention, create a trail, which delivers log files to an Amazon S3 bucket where they can be kept as long as required (or use CloudTrail Lake). CloudTrail records who did what, when and from where, which is what auditors need.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.