A payments processor sends its AWS CloudTrail events to a CloudWatch Logs log group. During an incident review, the security engineer must find which IAM principals made the most failed API calls in the last 24 hours, with the principal and the count shown for each.
The logs are already in CloudWatch Logs, and the answer is needed within minutes. The engineer must not copy or export the logs or build a new pipeline, and must not miss failures with error codes other than AccessDenied.
Which TWO query steps should the security engineer include in a CloudWatch Logs Insights query? (Choose two.)
Choose two answers.
AA. Group the events by sourceIPAddress instead, to see which network addresses made the most failed calls.
BB. Export the log group to an Amazon S3 bucket, then query the exported files with Amazon Athena to count the failed calls by principal.
CC. Filter the events to those where the errorCode field is present, using a filter ispresent(errorCode) statement.
DD. Filter the events where errorCode equals AccessDenied, since that is the most common failure that attackers trigger.
EE. Group the remaining events by userIdentity.arn with a stats count statement, sorted in descending order, so that the most active principals appear first.
Show the answer and explanation
Answers: C, E
A. Wrong: Source addresses show where calls came from, but the requirement asks which principal made them. One address can be shared by several principals, so this grouping gives the wrong answer.
B. Wrong: Exporting copies the logs, which the requirement rules out, and exports are not real time. The answer would arrive too late for the minutes-long window that the review needs.
D. Wrong: This filter finds only one failure code. Calls that return other codes, such as UnauthorizedOperation or InvalidClientTokenId, would be missed, which breaks the requirement to see all failures.
E. Right: Correct. A stats count grouped by userIdentity.arn returns one row for each principal with its number of failed calls. Sorting in descending order puts the principals with the most failures at the top.
Explanation
A Logs Insights query first keeps only failed calls, which CloudTrail marks with an errorCode field, and then counts them by principal. Together these steps answer the question in place, without copies or pipelines. Grouping by source address, exporting the logs and filtering on one error code each fail a requirement.
Want more on Analyzing and correlating logs (CloudWatch Logs Insights, Athena, OpenSearch)? The 5 full-length practice sets have 7 more Analyzing and correlating logs (CloudWatch Logs Insights, Athena, OpenSearch) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →