DOP-C02 practice question: CloudTrail, Access Analyzer, Inspector and auditing (1 of 2)
Security and Compliance A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A logistics company has 50 AWS accounts. Its security team needs an audit trail of API activity in every account and Region, and it must be able to prove that stored log files have not been changed or deleted.
The log files must be kept in a dedicated log archive account, so that the workload account administrators cannot read or alter them. Engineers in the workload accounts should not need to change their own trails.
Which configuration meets these requirements?
Choose one answer.
AA. Create a CloudTrail trail in each workload account that delivers to a bucket in that same account, with log file validation enabled and a bucket policy that the account administrators can edit.
BB. Enable AWS Config in each account with a configuration recorder, and deliver the configuration history to a bucket in the log archive account, so that every API call is recorded there.
CC. Create a CloudTrail trail in the management account for only the Organizations API calls, and rely on the workload accounts' default event history for their own API activity.
DD. Create an organization trail from the management account, delivering to a bucket in the log archive account with log file validation enabled and Object Lock turned on, and cover every Region in the trail.
B. Wrong: AWS Config records resource configuration changes, not the API call history that CloudTrail records. It does not provide the API audit trail the security team needs. Learn more: What is AWS Config? (opens in a new tab)
C. Wrong: Event history is short-lived and is not a stored, tamper-evident archive, and a trail for only one API set does not cover the workloads. The requirement covers every account and Region. Learn more: What is AWS CloudTrail? (opens in a new tab)
D. Right: Correct. An organization trail records API activity in every member account and Region and delivers it to one archive bucket. Log file validation proves the files are unchanged, and Object Lock stops them from being deleted or altered. Learn more: Creating a trail for an organization (opens in a new tab)
Explanation
An organization trail created from the management account records activity in every member account and Region and delivers it to a single archive account. Log file validation lets the team prove the files are unchanged, and Object Lock keeps them from being deleted or altered. Per-account trails, Config history and a narrow management trail each miss a requirement.
Log file validation proves the logs are unchanged, and Object Lock stops anyone deleting them.
Want more on CloudTrail, Access Analyzer, Inspector and auditing? The 5 full-length practice sets have 10 more CloudTrail, Access Analyzer, Inspector and auditing questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →