SOA-C03 practice question: CloudTrail and log analysis

Monitoring, Logging, Analysis, Remediation, and Performance Optimization A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

At a public library network, a DNS record in a Route 53 public hosted zone was deleted 10 days ago, and the catalog site went offline for an hour. The library's AWS account has no CloudTrail trail and AWS Config is not turned on.

The operations manager wants to know which IAM principal made the change, today, without new setup. The library's workloads run in the eu-west-1 Region.

What should a CloudOps engineer do?

Choose one answer.

A. Open CloudTrail Event history in the eu-west-1 Region and filter by the event name ChangeResourceRecordSets.
B. Create a CloudTrail trail that logs to Amazon S3, then query the trail's log files with Amazon Athena for the deletion.
C. Open the AWS Config timeline for the hosted zone and review which principal changed the record sets in it.
D. Open CloudTrail Event history in US East (N. Virginia) and filter by event name ChangeResourceRecordSets.

Show the answer and explanation

Answer: D

A. Wrong: Event history is per Region, and Route 53 is a global service whose management events are recorded in US East (N. Virginia). Searching eu-west-1 would not show the change. Learn more: Logging Amazon Route 53 API calls with AWS CloudTrail (opens in a new tab)
B. Wrong: A new trail records only events that happen after it is created. It cannot capture a change made 10 days ago, so Athena would find nothing. Learn more: Querying AWS CloudTrail logs (opens in a new tab)
C. Wrong: AWS Config records configuration changes only for resources it was recording at the time. Config is not turned on in this account, so there is no history to review. Learn more: What is AWS Config? (opens in a new tab)
D. Right: Correct. Event history keeps 90 days of management events with no trail needed. Route 53 is a global service, so its API calls are recorded in us-east-1, and the event shows the principal that deleted the record. Learn more: Working with CloudTrail event history (opens in a new tab)

Explanation

CloudTrail Event history is available in every account without setup and keeps 90 days of management events, which covers a change made 10 days ago. Calls to global services such as Route 53 and IAM are recorded in US East (N. Virginia), so that is the Region to search. Trails and Config only help for activity after they are turned on.

SOA-C03 practice question: CloudTrail and log analysis

Explanation

Study

Keep practicing