ExamPark
Course menuCLF-C02

Exams / CLF-C02 / Monitoring, logging and auditing / Question 2

CLF-C02 practice question: Monitoring, logging and auditing (2 of 2)

Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A company has 15 AWS accounts in AWS Organizations.

Its auditors need a record of every API call in all accounts, kept for five years in one central location. Today the security team checks each account's CloudTrail event history by hand.

Which approach meets the requirement with the LEAST manual work?

Choose one answer.

  1. A. Export each account's CloudTrail event history every quarter and save the files on a shared drive
  2. B. Create an organization trail that sends every account's logs to one S3 bucket kept five years
  3. C. Turn on AWS Config recording in each account, so every API call is stored as a configuration item
  4. D. Enable VPC flow logs in every VPC, so each network flow is stored with its source IP address, port and action
Show the answer and explanation

Answer: B

  • A. Wrong: Event history keeps only the past 90 days in each Region, and this manual export must be repeated for every account. It is not a continuous, central record for the whole organization.
  • B. Right: Correct. An organization trail logs events for the management account and every member account, and delivers them to one S3 bucket. A lifecycle rule on that bucket keeps the logs for five years, so no account needs manual work. Learn more: Creating a trail for an organization (opens in a new tab)
  • C. Wrong: AWS Config records configuration changes to resources, not every API call. It also needs setup in each account, so it does not meet the audit requirement.
  • D. Wrong: VPC flow logs record IP traffic metadata that passes through VPC network interfaces. They do not record AWS API calls, so they cannot serve as the audit record.

Explanation

An organization trail records API activity for the management account and all member accounts, and delivers the logs to one central S3 bucket. CloudTrail event history covers only the past 90 days in each Region, so it cannot be the audit record. AWS Config and VPC flow logs record different things, configuration changes and network traffic.

An organization trail delivering to a log archive account The management account creates one organization trail. It records activity in every member account, including new ones, in every Region, and delivers the logs to a central S3 bucket in the log archive account, protected with log file integrity validation and Object Lock. Management account creates the organization trail Member accounts Account Account New account every account and Region Log archive account Central S3 bucket integrity validation, Object Lock
One organization trail covers all 15 accounts and delivers every log to a single bucket kept for five years.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free CLF-C02 practice examPractice Monitoring, logging and auditingAll Monitoring, logging and auditing questions

Want more on Monitoring, logging and auditing? The 5 full-length practice sets have 10 more Monitoring, logging and auditing questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets