CloudTrail and log analysis: SOA-C03 study notes and practice questions
What to know about CloudTrail and log analysis for the SOA-C03 exam, from the Monitoring, Logging, Analysis, Remediation, and Performance Optimization domain (22% of the exam guide), then 1 free question to test it. Part of the SOA-C03 study guide.
Log questions ask where to find evidence of a change, how to search logs quickly, or how to turn log lines into metrics and alerts.
AWS CloudTrail
Event history is on in every account with no setup and keeps 90 days of management events, viewable and searchable in the console.
A trail delivers events to S3 (and optionally CloudWatch Logs) for longer retention and analysis. An organization trail covers all accounts.
Management events (control plane, such as RunInstances) are logged by default; data events (such as S3 object reads or Lambda invokes) must be turned on and cost extra.
CloudTrail Lake stores events in a queryable data store with SQL.
CloudTrail Insights flags unusual API call rates or error rates.
Log file integrity validation proves logs weren’t changed after delivery.
Amazon CloudWatch Logs
Logs are organized into log groups and log streams. Set a retention period per log group; the default is to keep logs forever.
CloudWatch Logs Insights runs queries across log groups (filter, stats, sort) without exporting data.
Metric filters turn matching log lines into metrics, which you can alarm on (for example, count of “ERROR”).
Subscription filters stream log events in near real time to Lambda, Kinesis Data Streams, Data Firehose or OpenSearch.
Export to S3 for archive or analysis with Athena (not real time).
Live Tail shows log events as they arrive, for troubleshooting.
At a public library network, a DNS record in a Route 53 public hosted zone was deleted 10 days ago, and the catalog site went offline for an hour. The library's AWS account has no CloudTrail trail and AWS Config is not turned on.
The operations manager wants to know which IAM principal made the change, today, without new setup. The library's workloads run in the eu-west-1 Region.
What should a CloudOps engineer do?
Choose one answer.
AA. Open CloudTrail Event history in the eu-west-1 Region and filter by the event name ChangeResourceRecordSets.
BB. Create a CloudTrail trail that logs to Amazon S3, then query the trail's log files with Amazon Athena for the deletion.
CC. Open the AWS Config timeline for the hosted zone and review which principal changed the record sets in it.
DD. Open CloudTrail Event history in US East (N. Virginia) and filter by event name ChangeResourceRecordSets.
C. Wrong: AWS Config records configuration changes only for resources it was recording at the time. Config is not turned on in this account, so there is no history to review. Learn more: What is AWS Config? (opens in a new tab)
D. Right: Correct. Event history keeps 90 days of management events with no trail needed. Route 53 is a global service, so its API calls are recorded in us-east-1, and the event shows the principal that deleted the record. Learn more: Working with CloudTrail event history (opens in a new tab)
Explanation
CloudTrail Event history is available in every account without setup and keeps 90 days of management events, which covers a change made 10 days ago. Calls to global services such as Route 53 and IAM are recorded in US East (N. Virginia), so that is the Region to search. Trails and Config only help for activity after they are turned on.
Want more on CloudTrail and log analysis? The 5 full-length practice sets have 8 more CloudTrail and log analysis questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →