ExamPark
Course menuCLF-C02

Exams / CLF-C02 / Study guide / Monitoring, logging and auditing

Monitoring, logging and auditing: CLF-C02 study notes and practice questions

What to know about Monitoring, logging and auditing for the CLF-C02 exam, from the Security and Compliance domain (30% of the exam guide), then 2 free questions to test it. Part of the CLF-C02 study guide.

Last verified against current AWS documentation ·How we write our questions

What to know for the exam

Three services sound alike and appear together as answer options all the time. Learn the question each one answers.

Service Answers Example
AWS CloudTrail “Who did what, and when?” Which user deleted this S3 bucket?
Amazon CloudWatch “How is it performing?” Alert when EC2 CPU stays above 80%
AWS Config “How is it configured, and did it change?” Which security groups allow SSH from anywhere?

CloudTrail

  • Records API calls made in the console, CLI, SDKs and by AWS services, including the user, time, source IP and request.
  • Event history keeps the last 90 days of management events at no charge; a trail delivers events to S3 for longer retention.
  • An organization trail logs every account in AWS Organizations to one central bucket.
  • Root user sign-ins are recorded too.

CloudWatch

  • Metrics from AWS services (such as CPU utilization) and custom metrics from your applications.
  • Alarms watch a metric and notify through Amazon SNS or take actions, such as scaling or stopping an instance.
  • CloudWatch Logs collects and searches log files.
  • Dashboards show metrics in one view.

Config

  • Keeps a history of resource configurations and changes.
  • Config rules check resources against your rules and flag non-compliant ones.
  • Amazon EventBridge reacts to events (such as a CloudTrail event or a schedule) by triggering targets.
  • AWS Health Dashboard shows AWS service events that affect your account.

Common traps

  • CloudWatch for “who changed it”. That’s CloudTrail.
  • CloudTrail for “alert on high CPU”. That’s a CloudWatch alarm.
  • CloudTrail vs Config. CloudTrail records the action; Config records the resulting configuration and whether it follows the rules.

Side by side: CloudTrail vs CloudWatch vs AWS Config

Try the 2 practice questions

Practice Monitoring, logging and auditingTake the free practice exam

Question 1

Easier ·Link to this question (question 1)

An operations team runs a web fleet of Amazon EC2 instances.

It wants an email sent to the on-call engineer whenever the average CPU use of an instance stays above 80% for ten minutes, without any change to the instances.

Which AWS service should the team use to watch this metric and send the alert?

Choose one answer.

  1. A. AWS CloudTrail, which records the API calls made in AWS accounts
  2. B. AWS Config, which records resource configuration changes and checks them against rules
  3. C. Amazon CloudWatch, with an alarm on the CPU metric that notifies an Amazon SNS topic
  4. D. AWS Trusted Advisor, which checks accounts against best-practice recommendations
Show the answer and explanation

Answer: C

  • A. Wrong: CloudTrail records API calls and account activity, which is useful for auditing who changed what. It does not track CPU utilization or send threshold-based alerts.
  • B. Wrong: AWS Config records configuration changes to resources and evaluates them against rules. It does not track a performance metric such as CPU use over time.
  • C. Right: Correct. CloudWatch collects metrics such as EC2 CPU utilization. A metric alarm watches the metric over a set number of periods and can send a notification to an SNS topic when the threshold is crossed. Learn more: Using Amazon CloudWatch alarms (opens in a new tab)
  • D. Wrong: Trusted Advisor checks accounts against best-practice recommendations, such as cost and security checks. It does not watch live CPU metrics or send alerts when they exceed a threshold.

Explanation

CloudWatch collects metrics such as EC2 CPU utilization, and its alarms watch a metric over a period and act when a threshold is crossed. An alarm can notify an SNS topic that emails the on-call engineer. CloudTrail, Config and Trusted Advisor provide other kinds of logging, configuration and guidance.

Study

Question 2

Medium ·Link to this question (question 2)

A company has 15 AWS accounts in AWS Organizations.

Its auditors need a record of every API call in all accounts, kept for five years in one central location. Today the security team checks each account's CloudTrail event history by hand.

Which approach meets the requirement with the LEAST manual work?

Choose one answer.

  1. A. Export each account's CloudTrail event history every quarter and save the files on a shared drive
  2. B. Create an organization trail that sends every account's logs to one S3 bucket kept five years
  3. C. Turn on AWS Config recording in each account, so every API call is stored as a configuration item
  4. D. Enable VPC flow logs in every VPC, so each network flow is stored with its source IP address, port and action
Show the answer and explanation

Answer: B

  • A. Wrong: Event history keeps only the past 90 days in each Region, and this manual export must be repeated for every account. It is not a continuous, central record for the whole organization.
  • B. Right: Correct. An organization trail logs events for the management account and every member account, and delivers them to one S3 bucket. A lifecycle rule on that bucket keeps the logs for five years, so no account needs manual work. Learn more: Creating a trail for an organization (opens in a new tab)
  • C. Wrong: AWS Config records configuration changes to resources, not every API call. It also needs setup in each account, so it does not meet the audit requirement.
  • D. Wrong: VPC flow logs record IP traffic metadata that passes through VPC network interfaces. They do not record AWS API calls, so they cannot serve as the audit record.

Explanation

An organization trail records API activity for the management account and all member accounts, and delivers the logs to one central S3 bucket. CloudTrail event history covers only the past 90 days in each Region, so it cannot be the audit record. AWS Config and VPC flow logs record different things, configuration changes and network traffic.

An organization trail delivering to a log archive account The management account creates one organization trail. It records activity in every member account, including new ones, in every Region, and delivers the logs to a central S3 bucket in the log archive account, protected with log file integrity validation and Object Lock. Management account creates the organization trail Member accounts Account Account New account every account and Region Log archive account Central S3 bucket integrity validation, Object Lock
One organization trail covers all 15 accounts and delivers every log to a single bucket kept for five years.

Study

Want more on Monitoring, logging and auditing? The 5 full-length practice sets have 10 more Monitoring, logging and auditing questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study Monitoring, logging and auditing

More Security and Compliance topics