CloudTrail, Access Analyzer, Inspector and auditing: DOP-C02 study notes and practice questions
What to know about CloudTrail, Access Analyzer, Inspector and auditing for the DOP-C02 exam, from the Security and Compliance domain (17% of the exam guide), then 2 free questions to test it. Part of the DOP-C02 study guide.
These questions ask how to prove what happened across all accounts, and find access that shouldn’t exist.
CloudTrail
An organization trail from the management account (or delegated admin) records every member account and Region, delivered to an S3 bucket in a log archive account.
Log file validation produces digest files that prove logs weren’t changed or deleted.
Management events are on by default; data events (S3 object access, Lambda invokes) and network activity events for VPC endpoints are optional and cost extra.
CloudTrail Lake stores events in event data stores you query with SQL, with long retention and organization-wide collection.
CloudTrail Insights detects unusual API call rates or error rates.
Protecting the trail
Encrypt with SSE-KMS; restrict the bucket to the log archive account’s security team.
Use S3 Object Lock for immutability and an SCP that denies stopping or deleting trails.
Send to CloudWatch Logs for alarms on sensitive actions (such as root sign-in or policy changes).
IAM Access Analyzer
External access analyzers (account or organization zone of trust) report resources shared outside the organization: buckets, roles, keys, queues, secrets, snapshots.
Internal access findings show who inside the organization can reach critical resources.
Unused access findings list roles, keys, passwords and permissions not used recently.
Policy validation and custom policy checks in pipelines catch bad policies before deployment.
Other audit tools
Amazon Inspector for vulnerabilities across EC2, ECR and Lambda, organization-wide.
AWS Audit Manager collects evidence against frameworks.
AWS Config history and conformance packs for configuration evidence.
Credential reports list users and key ages.
Common traps
Trails per account that local admins can stop.
No log file validation when integrity must be proven.
A logistics company has 50 AWS accounts. Its security team needs an audit trail of API activity in every account and Region, and it must be able to prove that stored log files have not been changed or deleted.
The log files must be kept in a dedicated log archive account, so that the workload account administrators cannot read or alter them. Engineers in the workload accounts should not need to change their own trails.
Which configuration meets these requirements?
Choose one answer.
AA. Create a CloudTrail trail in each workload account that delivers to a bucket in that same account, with log file validation enabled and a bucket policy that the account administrators can edit.
BB. Enable AWS Config in each account with a configuration recorder, and deliver the configuration history to a bucket in the log archive account, so that every API call is recorded there.
CC. Create a CloudTrail trail in the management account for only the Organizations API calls, and rely on the workload accounts' default event history for their own API activity.
DD. Create an organization trail from the management account, delivering to a bucket in the log archive account with log file validation enabled and Object Lock turned on, and cover every Region in the trail.
B. Wrong: AWS Config records resource configuration changes, not the API call history that CloudTrail records. It does not provide the API audit trail the security team needs. Learn more: What is AWS Config? (opens in a new tab)
C. Wrong: Event history is short-lived and is not a stored, tamper-evident archive, and a trail for only one API set does not cover the workloads. The requirement covers every account and Region. Learn more: What is AWS CloudTrail? (opens in a new tab)
D. Right: Correct. An organization trail records API activity in every member account and Region and delivers it to one archive bucket. Log file validation proves the files are unchanged, and Object Lock stops them from being deleted or altered. Learn more: Creating a trail for an organization (opens in a new tab)
Explanation
An organization trail created from the management account records activity in every member account and Region and delivers it to a single archive account. Log file validation lets the team prove the files are unchanged, and Object Lock keeps them from being deleted or altered. Per-account trails, Config history and a narrow management trail each miss a requirement.
Log file validation proves the logs are unchanged, and Object Lock stops anyone deleting them.
An insurance firm runs 80 AWS accounts through AWS Organizations. The security team wants to find resources such as S3 buckets and IAM roles that are shared outside the organization, and it wants to remove permissions that roles have never used.
Findings must come from configuration analysis in each account, without the team writing its own analyzer, and the results should be reviewable in one place for the whole organization. The security team reviews the findings each week and needs them grouped by account.
Which TWO actions meet these requirements? (Choose two.)
Choose two answers.
AA. Create an IAM Access Analyzer analyzer at the organization level, so that it reports resources that grant access to principals outside the organization.
BB. Turn on Amazon Inspector in every account and review its findings for resources that are shared outside the organization, since Inspector covers resource exposure.
CC. Create an AWS Config rule that marks any IAM role with broad permissions as noncompliant, and let the rule remove those permissions automatically when it detects them.
DD. Create an IAM Access Analyzer unused access analyzer for the organization, so that the team sees roles, users and permissions that have not been used within the tracking period and can remove them.
EE. Create a GuardDuty detector in every account and send its findings for all IAM roles to the security team, since GuardDuty reports each unused role it observes.
B. Wrong: Inspector assesses vulnerabilities and network exposure for certain resources, but it does not analyze resource-based sharing with external principals. The requirement is about access sharing, which Inspector does not cover. Learn more: What is Amazon Inspector? (opens in a new tab)
D. Right: Correct. An unused access analyzer continuously monitors the IAM roles and users across the organization and reports unused roles, access keys and permissions. The findings give the team a reviewable list to reduce. Learn more: IAM Access Analyzer findings (opens in a new tab)
An organization-level IAM Access Analyzer external access analyzer reports resources shared outside the organization, and its unused access findings list roles and permissions that have not been used in the tracking period. Both run without a custom analyzer and report centrally. Inspector and GuardDuty assess other risks, and a broad-permissions rule does not identify unused access.
Want more on CloudTrail, Access Analyzer, Inspector and auditing? The 5 full-length practice sets have 10 more CloudTrail, Access Analyzer, Inspector and auditing questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study CloudTrail, Access Analyzer, Inspector and auditing