Courseiva

CCNA Security Logging Questions

17 of 92 questions · Page 2/2 · Security Logging topic · Answers revealed

Practice these questionsExam hubAll questions
76
MCQhard

A company uses AWS Organizations with multiple accounts. They want to centralize logging of all API calls across all accounts and store them in a single S3 bucket. Which configuration should be used?

A.Use AWS Config to record API calls across all accounts
B.Create a separate CloudTrail trail in each account and aggregate logs using Amazon Athena
C.Create an organization trail in the management account
D.Enable VPC Flow Logs in each account and send to a central S3 bucket
AnswerC

Organization trails log events for all accounts and deliver to a single bucket.

Why this answer

AWS Organizations allows you to create an organization trail in the management account that automatically logs API calls for all member accounts. This centralizes CloudTrail logs into a single S3 bucket without needing to configure individual trails per account, ensuring complete coverage and simplified management.

Exam trap

The trap here is that candidates often confuse AWS Config (which records configuration changes) with CloudTrail (which records API calls), or they think VPC Flow Logs can substitute for API logging, leading them to select options that do not meet the requirement for centralized API call logging.

How to eliminate wrong answers

Option A is wrong because AWS Config records resource configuration changes, not API calls; it does not capture the detailed API activity that CloudTrail provides. Option B is wrong because while separate trails per account can send logs to a central bucket, this approach is redundant and harder to manage compared to an organization trail, and Athena is a query service, not a logging aggregation service. Option D is wrong because VPC Flow Logs capture network traffic metadata (IP addresses, ports, protocols), not API calls; they are used for network analysis, not API activity logging.

Practice this question →
77
MCQmedium

A company uses AWS Organizations with multiple accounts. The security team needs to centrally monitor all API calls made in the member accounts. The team wants to ensure that all CloudTrail logs are delivered to a centralized S3 bucket in the management account. Which configuration should the security team implement?

A.Configure CloudWatch cross-account subscription to send logs from member accounts to the management account.
B.Enable CloudTrail in each member account and configure each trail to deliver logs to the same S3 bucket.
C.Create an organization trail in the management account with the S3 bucket in the management account.
D.Use Amazon S3 replication to copy logs from member account buckets to the management account bucket.
AnswerC

An organization trail is created only in the management account (or delegated administrator) and automatically applies to all accounts in the AWS organization, with no per-account setup required. It records management events across all accounts, including AWS Organizations control-plane operations like CreateAccount and AttachPolicy, and delivers the aggregated logs to a single S3 bucket in the management account. This is the correct way to centrally collect CloudTrail logs for governance and compliance.

Why this answer

AWS Organizations supports creating an organization trail in the management account that automatically applies to all member accounts. This ensures that all API calls from every account in the organization are logged and delivered to a centralized S3 bucket in the management account without needing to configure individual trails or manage cross-account permissions manually.

Exam trap

The trap here is that candidates often think they need to configure CloudTrail in each member account individually (Option B) or use S3 replication (Option D), missing the fact that AWS Organizations provides a native, centralized organization trail feature that automatically applies to all accounts.

How to eliminate wrong answers

Option A is wrong because CloudWatch cross-account subscription is designed for streaming log data to a central account for real-time monitoring, not for delivering CloudTrail logs to an S3 bucket; CloudTrail logs are stored in S3, not CloudWatch Logs by default. Option B is wrong because while it would technically deliver logs to the same S3 bucket, it requires manual configuration in each member account, does not leverage the centralized management capabilities of AWS Organizations, and can lead to permission issues or inconsistent configurations. Option D is wrong because S3 replication copies objects between buckets after they are written, but it introduces complexity, additional costs, and potential delays; it does not provide a native, centralized way to ensure all CloudTrail logs are delivered directly to the management account bucket without first storing them in member account buckets.

Practice this question →
78
MCQeasy

A company is required to retain CloudTrail logs for 7 years for compliance. Which solution meets this requirement with the LEAST operational overhead?

A.Store logs in CloudWatch Logs with a retention period of 7 years.
B.Configure CloudTrail to automatically delete logs older than 7 years.
C.Use an AWS Lambda function to delete logs older than 7 years.
D.Configure an S3 Lifecycle policy to transition logs to S3 Glacier Deep Archive after 90 days and expire after 7 years.
E.Export logs to AWS Snowball for offline archival.
AnswerD

Lifecycle policies automate retention and minimize costs.

Why this answer

It uses an S3 Lifecycle policy to automatically transition CloudTrail logs to S3 Glacier Deep Archive after 90 days (reducing storage costs) and then expire (delete) the objects after 7 years, meeting the retention requirement with zero ongoing operational effort. This is the least operational overhead solution as it is fully automated within S3, requiring no custom code, manual intervention, or additional services.

Exam trap

The trap here is that candidates may think CloudTrail itself manages log retention (Option B) or that CloudWatch Logs is the simplest option (Option A), but AWS explicitly requires you to manage retention at the destination, and S3 Lifecycle policies are the native, automated, and lowest-overhead solution for long-term archival and deletion.

How to eliminate wrong answers

Option A is wrong because CloudWatch Logs has a maximum retention period of 10 years, but storing 7 years of CloudTrail logs in CloudWatch Logs incurs high ingestion and storage costs compared to S3, and requires manual or automated export for long-term archival, increasing operational overhead. Option B is wrong because CloudTrail does not have a built-in feature to automatically delete logs older than a specified period; log retention and deletion must be managed at the destination (e.g., S3 Lifecycle policies). Option C is wrong because using a Lambda function to delete logs older than 7 years introduces custom code, potential execution failures, and ongoing maintenance, which is higher operational overhead than a native S3 Lifecycle policy.

Option E is wrong because exporting logs to AWS Snowball for offline archival is designed for large-scale data transfer and physical shipping, not for routine 7-year retention, and it adds significant operational overhead and latency.

Practice this question →
79
MCQmedium

A security analyst needs to review all failed SSH login attempts to an EC2 instance. Which combination will provide this information?

A.Use AWS Config to record EC2 instance configuration and check for security group changes.
B.Install the CloudWatch agent on the EC2 instance to collect /var/log/secure and stream to CloudWatch Logs.
C.Enable AWS CloudTrail and search for EC2-related events.
D.Enable VPC Flow Logs for the subnet and query the logs in CloudWatch Logs Insights for rejected traffic on port 22.
AnswerB

The CloudWatch agent (or unified agent) runs inside the EC2 instance and can tail local log files such as /var/log/secure on Amazon Linux/RHEL (or /var/log/auth.log on Ubuntu), streaming them to CloudWatch Logs. The sshd daemon writes entries like 'Failed password for ...' to this file for every failed authentication attempt. Reviewing the collected log group in CloudWatch Logs Insights, for example with a query filtering on 'Failed password', directly reveals the failed SSH login attempts and their source IPs.

Why this answer

The CloudWatch agent installed on the EC2 instance can collect OS-level logs such as /var/log/secure (on Linux), which contains detailed records of SSH authentication attempts, including failed logins. By streaming these logs to CloudWatch Logs, the analyst can query and review all failed SSH login attempts at the application layer. Options A, C, and D capture network-level metadata but do not provide information about authentication failures after a successful TCP connection.

Exam trap

The key pitfall is interpreting 'failed SSH login attempts' as network-level rejections rather than OS-level authentication failures. VPC Flow Logs show only accepted or rejected network traffic, not login outcomes. The correct approach is to collect system authentication logs via the CloudWatch agent.

How to eliminate wrong answers

Option A is wrong because AWS Config records resource configuration changes, not network traffic or login attempts; it cannot capture failed SSH login events. Option B is wrong because /var/log/secure logs successful and failed authentication attempts at the OS level, but the question asks for 'failed SSH login attempts' as seen from the network perspective, and the CloudWatch agent collects OS logs, not network-level rejected packets. Option C is wrong because AWS CloudTrail records API calls made to the AWS management plane, not network traffic or SSH login attempts to the EC2 instance itself.

Practice this question →
80
MCQeasy

A security engineer wants to capture all DNS queries made by EC2 instances to detect potential data exfiltration. Which AWS service should be used to log the DNS requests?

A.Use Route 53 Resolver DNS Firewall with query logging
B.Use Amazon GuardDuty
C.Enable VPC Flow Logs
D.Enable AWS CloudTrail
AnswerA

DNS Firewall can log DNS queries for VPCs.

Why this answer

Route 53 Resolver DNS Firewall with query logging is the correct choice because it is specifically designed to log all DNS queries made by EC2 instances that use the Route 53 Resolver. This service captures the domain names being queried, the source IP, and the response, enabling detection of DNS-based data exfiltration (e.g., DNS tunneling). It integrates directly with the VPC's DNS resolver, ensuring all outbound DNS traffic from EC2 instances is logged without additional agents.

Exam trap

The trap here is that candidates often confuse VPC Flow Logs (which show IP-level metadata) with DNS query logs, not realizing that DNS exfiltration requires the actual domain names being queried, which only DNS-specific logging provides.

How to eliminate wrong answers

Option B is wrong because Amazon GuardDuty is a threat detection service that analyzes DNS logs from Route 53 Resolver DNS Firewall or other sources, but it does not itself capture or log raw DNS queries; it relies on existing logs. Option C is wrong because VPC Flow Logs capture metadata about IP traffic (source/destination IP, ports, protocol) but do not log the actual DNS query names or payloads, making them insufficient for detecting DNS exfiltration. Option D is wrong because AWS CloudTrail logs API calls to AWS services (e.g., Route 53 API calls) but does not capture the DNS queries made by EC2 instances to external domains.

Practice this question →
81
MCQeasy

A security engineer is responsible for monitoring AWS account activity. The engineer needs to receive real-time notifications when specific API calls are made, such as 'DeleteTrail' or 'UpdateTrail'. The engineer wants to use AWS services to achieve this with minimal latency. Which combination of services should the engineer use?

A.CloudTrail -> Amazon EventBridge -> Amazon SNS
B.CloudTrail -> Amazon S3 -> S3 event notification -> AWS Lambda -> Amazon SNS
C.CloudTrail -> CloudWatch Logs -> CloudWatch Logs subscription filter -> AWS Lambda -> Amazon SNS
D.CloudTrail -> CloudWatch Logs -> CloudWatch metric filter -> CloudWatch alarm -> Amazon SNS
AnswerD

This architecture provides near real-time alerting based on API calls.

Why this answer

The correct solution is to send CloudTrail logs to CloudWatch Logs, create a metric filter to match the specific API calls (e.g., 'DeleteTrail', 'UpdateTrail'), and set up a CloudWatch alarm on that metric that publishes to an SNS topic. This provides near-real-time alerts. Option D is correct.

Option A is incorrect because while CloudTrail can send events to EventBridge, the event delivery is not as immediate as CloudWatch Logs metric filter approach for this use case. Option B is incorrect because S3 event notifications are for object-level events and not suitable for monitoring CloudTrail API calls. Option C is incorrect because CloudWatch Logs subscription filters are for streaming logs to other destinations, not for directly triggering alarms.

Practice this question →
82
MCQmedium

A security engineer is troubleshooting why CloudTrail is not delivering logs to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured with the correct bucket name. However, no log files appear. What is the most likely cause?

A.The S3 bucket has an S3 Object Lock configuration that prevents writes.
B.The S3 bucket is in a different AWS Region from the trail.
C.CloudTrail is not enabled in the AWS Region where the S3 bucket resides.
D.The S3 bucket uses AWS KMS server-side encryption (SSE-KMS) and the KMS key policy does not grant CloudTrail permission to use the key.
AnswerD

When a destination bucket uses SSE-KMS, CloudTrail must have permission to call kms:GenerateDataKey for encrypting each log file and kms:Decrypt for delivering or reading those files. If the KMS key policy does not explicitly grant CloudTrail these actions, PutObject requests to the bucket will fail even if the bucket policy is correct. CloudTrail’s role also needs the appropriate KMS permissions in the trail’s advanced settings, but the key policy is the critical constraint here.

Why this answer

When CloudTrail is configured to deliver logs to an S3 bucket that uses SSE-KMS, CloudTrail must have explicit permission to use the KMS key for encrypting the log files. Even if the bucket policy allows CloudTrail to write objects, the KMS key policy must grant the `kms:GenerateDataKey` and `kms:Decrypt` actions to the CloudTrail service principal. Without these permissions, CloudTrail cannot encrypt the logs, and delivery fails silently—no log files appear.

Exam trap

The trap here is that candidates often focus only on the S3 bucket policy and overlook the separate KMS key policy requirement, assuming that SSE-KMS encryption is transparent to CloudTrail.

How to eliminate wrong answers

Option A is wrong because S3 Object Lock, when configured, prevents object deletion or overwrite, but it does not prevent initial writes; CloudTrail can still create new log objects. Option B is wrong because CloudTrail can deliver logs to an S3 bucket in a different AWS Region; cross-region delivery is supported and not a cause of failure. Option C is wrong because CloudTrail is enabled in the region where the trail is created, not necessarily where the S3 bucket resides; the trail's region determines logging, not the bucket's region.

Practice this question →
83
Multi-Selecteasy

A security engineer needs to ensure that all API calls in an AWS account are logged for auditing purposes. Which TWO services should the engineer enable? (Select TWO.)

Select 2 answers
A.VPC Flow Logs
B.AWS CloudTrail
C.Amazon CloudWatch Logs
D.Amazon GuardDuty
E.AWS Config
AnswersB, E

CloudTrail logs API calls for governance and auditing.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity of the caller, the time of the call, the source IP address, and the request parameters. This provides a complete audit trail of all management and data plane operations, which is essential for security auditing and compliance.

Exam trap

The trap here is that candidates often confuse VPC Flow Logs (network traffic) with API call logging, or think CloudWatch Logs is the primary logging service, when in fact CloudTrail is the dedicated service for API auditing.

Practice this question →
84
MCQhard

A company uses Amazon GuardDuty to monitor for threats. The security team receives a high-severity finding: 'UnauthorizedAccess:EC2/SSHBruteForce'. The finding indicates a single EC2 instance with a public IP is receiving SSH connection attempts from multiple external IPs. The instance is part of an Auto Scaling group and is fronted by an Application Load Balancer (ALB). The security team wants to block the attacking IPs without disrupting legitimate traffic. What is the MOST effective approach?

A.Stop the EC2 instance and launch a new one in a different subnet.
B.Modify the security group of the EC2 instance to deny inbound SSH from the attacking IPs.
C.Create a network ACL rule on the subnet to deny inbound traffic from the attacking IPs.
D.Configure AWS WAF on the ALB to block the attacking IPs using an IP set rule.
AnswerB

Modifying the security group to deny inbound SSH from the attacking IPs directly blocks the SSH brute force attempts at the instance level. Since the instance uses a security group that can be applied to all instances in the Auto Scaling group, this approach is effective and persistent.

Why this answer

Modifying the security group of the EC2 instance to deny inbound SSH from the attacking IPs directly blocks the SSH brute force attempts at the instance level. Since the instance is part of an Auto Scaling group, security group modifications will apply to all instances launched with that security group, and updates are immediate. Option D (AWS WAF on ALB) is ineffective because WAF only inspects HTTP/HTTPS traffic at Layer 7, while SSH traffic operates at Layer 4 and does not pass through the ALB; the ALB only handles HTTP/HTTPS, not SSH.

The attackers are targeting the instance's public IP directly over SSH, not through the ALB. Therefore, WAF cannot block SSH traffic. Option A (stop instance) is disruptive and unnecessary.

Option C (network ACL) would block traffic at the subnet level but would affect all instances in the subnet and is less granular than a security group.

Exam trap

The trap is that candidates assume AWS WAF can block any type of traffic when attached to an ALB, but WAF only inspects HTTP/HTTPS requests at Layer 7, not SSH traffic at Layer 4. The correct approach is to use a security group to block SSH at the instance level.

How to eliminate wrong answers

Option A is wrong because stopping the EC2 instance and launching a new one in a different subnet does not block the attacking IPs; it only changes the instance's IP address, and the attackers can still target the new instance. Option B is wrong because modifying the security group to deny inbound SSH from the attacking IPs would block SSH from those IPs but would also disrupt legitimate SSH traffic from those IPs if any existed, and it does not address the fact that the instance is behind an ALB where SSH traffic typically bypasses the ALB; moreover, security group rules are stateful and cannot block traffic at the application layer. Option C is wrong because creating a network ACL rule to deny inbound traffic from the attacking IPs would block all traffic from those IPs at the subnet level, including legitimate traffic (e.g., HTTP/HTTPS via the ALB), and network ACLs are stateless, requiring separate inbound and outbound rules, which complicates management and can disrupt legitimate traffic.

Practice this question →
85
Multi-Selecteasy

Which TWO AWS services can be used to monitor network traffic for malicious activity? (Select TWO.)

Select 2 answers
A.AWS Network Firewall
B.Amazon GuardDuty
C.AWS Shield
D.AWS WAF
E.Amazon Inspector
AnswersA, B

Network Firewall provides stateful inspection and threat detection.

Why this answer

AWS Network Firewall is a managed service that provides network layer filtering and intrusion prevention. It can inspect traffic at layers 3–7 using stateful rules, domain lists, and Suricata-compatible IPS signatures to detect and block malicious activity such as exploits or malware command-and-control traffic. Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence (e.g., known malicious IPs, domain reputation) to monitor VPC Flow Logs, DNS logs, and CloudTrail events for suspicious network behavior like port scanning or crypto-mining traffic.

Exam trap

The trap here is that candidates confuse AWS Shield (DDoS protection) or AWS WAF (web application firewall) with network traffic monitoring, but neither performs deep packet inspection or threat detection for general malicious network activity beyond their specific scopes.

Practice this question →
86
MCQhard

Refer to the exhibit. A security engineer wants to monitor a Lambda function for errors and create a CloudWatch alarm when errors exceed a threshold. The engineer notices the log group exists but has no metric filters. What should the engineer do to set up the alarm?

A.Enable CloudWatch Contributor Insights for the Lambda function to automatically detect errors.
B.Create a metric filter on the log group to count occurrences of 'ERROR' in log streams, then create an alarm based on that metric.
C.Configure the Lambda function to publish custom metrics for errors instead of relying on logs.
D.Use CloudWatch Logs Insights to query logs for errors and create an alarm directly from the query results.
AnswerB

This is the standard approach: define a metric filter to extract error counts from logs, then create an alarm.

Why this answer

CloudWatch Logs metric filters allow you to extract and count specific patterns (like 'ERROR') from log streams, and then create a CloudWatch alarm based on that metric. This directly addresses the requirement to monitor the Lambda function for errors without needing to modify the function code or rely on external tools.

Exam trap

The trap here is that candidates may confuse CloudWatch Logs Insights (a query tool) with metric filters (a real-time monitoring mechanism), or assume that Contributor Insights can generate alarms, when in fact only metric filters can directly feed into CloudWatch alarms.

How to eliminate wrong answers

Option A is wrong because CloudWatch Contributor Insights analyzes log data to identify top contributors (e.g., IP addresses), not to count error occurrences or trigger alarms based on error thresholds. Option C is wrong because publishing custom metrics from the Lambda function would require code changes and does not leverage the existing log group, which the engineer wants to use. Option D is wrong because CloudWatch Logs Insights is a query tool for ad-hoc analysis and cannot directly create alarms; alarms must be based on metric filters or other metric sources.

Practice this question →
87
MCQhard

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all accounts have CloudTrail enabled and that logs are delivered to a centralized S3 bucket in the management account. Which solution meets these requirements?

A.Write a script that runs in each account using AWS Lambda to enable CloudTrail and point to the central bucket.
B.Use AWS Config rules in each account to check CloudTrail status and remediate via Lambda.
C.Use AWS CloudTrail with Organizations to create an organization trail that logs all accounts to the central bucket.
D.Create an IAM role that each account assumes to enable CloudTrail and log to the central bucket.
AnswerC

Creating an organization trail in the management account (with isOrganizationTrail set to true) automatically provisions CloudTrail for every current and future member account in AWS Organizations, delivering logs to a single central S3 bucket. Member account users—even those with administrative rights—cannot disable or alter the trail because ownership rests with the management account, eliminating the need for per-account configuration or remediation. This native, centralized governance model is exactly why recommended architectures consistently select this option over per-account scripts, roles, or Config checks.

Why this answer

AWS CloudTrail supports integration with AWS Organizations, allowing you to create an organization trail that automatically logs events for all accounts in the organization. This trail delivers log files to a single centralized S3 bucket in the management account without requiring per-account configuration, ensuring compliance with the security team's requirement.

Exam trap

The trap here is that candidates often assume they must enable CloudTrail individually in each account or use complex cross-account IAM roles, overlooking the native AWS Organizations integration that automatically applies a single trail to all accounts.

How to eliminate wrong answers

Option A is wrong because it relies on a script running in each account via Lambda, which is operationally complex, not scalable, and does not leverage the native multi-account capabilities of CloudTrail; it also risks missing accounts or failing to maintain consistent configuration. Option B is wrong because AWS Config rules can only detect and remediate non-compliance after the fact, not proactively enable CloudTrail across all accounts, and the remediation Lambda would need to be deployed in each account, adding overhead and potential latency. Option D is wrong because creating an IAM role for each account to assume does not automatically enable CloudTrail; it only provides permissions, and the actual enabling would still require manual or scripted actions in each account, failing to meet the requirement for a centralized, automated solution.

Practice this question →
88
Multi-Selecthard

A security engineer is investigating a potential security incident. The engineer has enabled CloudTrail and VPC Flow Logs. Which THREE pieces of information can the engineer obtain from CloudTrail logs that are NOT available in VPC Flow Logs? (Choose three.)

Select 3 answers
A.The payload of the API request.
B.The AWS Region where the API call was made.
C.The destination IP address and port of the network traffic.
D.The IAM user or role that performed the API call.
E.The source IP address of the API call.
AnswersB, D, E

The AWS Region where the API call was made is a definitive field in CloudTrail's event history (the awsRegion attribute), whereas VPC Flow Logs are tied to a specific VPC and only describe traffic within that VPC's region. An API call's endpoint region may differ from the region of the VPC through which the traffic flows, so only CloudTrail provides this region information.

Why this answer

CloudTrail logs capture management-plane API calls, including the AWS Region where the call was made (via the 'awsRegion' field). VPC Flow Logs only capture network-level metadata (IP addresses, ports, protocols) and have no visibility into the AWS Region of an API call because they operate at Layer 3/4 of the OSI model and do not log control-plane events. Therefore, the Region information is uniquely available in CloudTrail.

Exam trap

The trap here is that candidates assume CloudTrail logs contain the full request payload (Option A) because they confuse CloudTrail with AWS Config or data-plane logging, but CloudTrail explicitly excludes payload data to avoid storing sensitive information.

Practice this question →
89
Multi-Selecthard

A company is designing a centralized logging solution for multiple AWS accounts. The logs must be encrypted at rest and in transit, and access must be audited. Which TWO actions should be taken? (Choose TWO.)

Select 2 answers
A.Configure cross-account CloudWatch Logs subscription to aggregate logs centrally.
B.Enable S3 server access logs on the central bucket for auditing.
C.Configure the S3 bucket policy to restrict PutObject to the CloudTrail service principal with a condition on aws:SourceArn.
D.Use AWS KMS customer managed keys (CMK) to encrypt the central S3 bucket.
E.Use VPC endpoints to ensure logs are transmitted over the AWS network.
AnswersC, D

Correct. A bucket policy with PutObject restricted to the CloudTrail service principal and a condition on aws:SourceArn ensures only authorized CloudTrail trails can deliver logs, providing secure aggregation and auditability.

Why this answer

To centrally aggregate logs from multiple AWS accounts while ensuring encryption at rest and in transit, and auditing access, two key actions are required. First, configure the central S3 bucket with a bucket policy that restricts PutObject to the CloudTrail service principal with a condition on aws:SourceArn (Option C). This ensures only the intended CloudTrail trails from designated accounts can write logs, providing security and auditability.

Second, use AWS KMS customer managed keys (CMK) to encrypt the central S3 bucket (Option D). This gives you control over the encryption keys and enables auditing of key usage via CloudTrail. Option A is incorrect because cross-account CloudWatch Logs subscription requires additional configuration and does not inherently provide encryption at rest with KMS control.

Option B is wrong because enabling S3 server access logs does not encrypt the logs nor restrict write access; it logs access to the bucket itself. Option E is incorrect because VPC endpoints ensure traffic stays within the AWS network but do not provide encryption at rest or the granular write restrictions needed.

Practice this question →
90
MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to centralize the collection of VPC Flow Logs and AWS CloudTrail logs from all accounts into a single Amazon S3 bucket in the management account. The S3 bucket policy must allow cross-account log delivery. Which condition in the bucket policy should be used to restrict log delivery to only the organization's accounts?

A.aws:SourceArn
B.aws:SourceOrgId
C.aws:SourceAccount
D.aws:PrincipalOrgID
AnswerD

aws:PrincipalOrgID is a global IAM condition key that compares the unique organization ID of the principal's AWS account to the value you specify. In an S3 bucket policy, setting "aws:PrincipalOrgID": "o-12345" allows any principal from any account within that organization to deliver logs, automatically covering new accounts as they join. Because it operates on the principal's organization rather than the request source, it is the most scalable and appropriate condition for this cross-account logging scenario.

Why this answer

The correct condition key is `aws:PrincipalOrgID`, which restricts access to principals (accounts, IAM roles, or users) that are members of the specified AWS Organization. When used in a bucket policy, it ensures that only accounts within the company's organization can deliver logs to the S3 bucket, even if the source account ID changes. Note that `aws:SourceOrgId` is not a valid AWS condition key; `aws:PrincipalOrgID` is the appropriate key for this purpose.

Exam trap

Candidates often confuse `aws:PrincipalOrgID` with `aws:SourceOrgId`. However, `aws:SourceOrgId` is not a valid AWS condition key. The correct key for restricting based on organization membership is `aws:PrincipalOrgID`.

For cross-account log delivery, `aws:PrincipalOrgID` ensures that only accounts within the specified organization can perform the action.

How to eliminate wrong answers

Option A is wrong because `aws:SourceArn` is used to restrict access based on the exact ARN of the resource making the request, which is not suitable for cross-account log delivery from multiple accounts where the source ARN varies. Option C is wrong because `aws:SourceAccount` restricts based on a single AWS account ID, which would require listing every account in the organization and would not automatically include new accounts added later. Option D is wrong because `aws:PrincipalOrgID` is the correct key, but the option is mislabeled as `aws:SourceOrgId` in the question; the actual correct key is `aws:PrincipalOrgID`, not `aws:SourceOrgId`.

Practice this question →
91
Multi-Selectmedium

A company needs to ensure that all API calls made to AWS are logged and that the logs are immutable. Which TWO steps should be taken? (Choose TWO.)

Select 2 answers
A.Enable CloudTrail log file validation.
B.Enable AWS CloudTrail in all regions.
C.Store CloudTrail logs in an S3 bucket with Object Lock enabled in Compliance mode.
D.Send CloudTrail logs to CloudWatch Logs with a retention policy.
E.Enable S3 versioning on the destination bucket.
AnswersB, C

CloudTrail logs all API calls across regions.

Why this answer

Enabling AWS CloudTrail in all regions ensures that all management events across every region are logged, which is essential for comprehensive security monitoring and compliance. However, note that data events (e.g., S3 object-level operations) require explicit configuration in the trail. Option C is correct because storing CloudTrail logs in an S3 bucket with Object Lock enabled in Compliance mode prevents any user, including the root user, from deleting or overwriting log files, ensuring immutability.

Together, these steps satisfy the requirement that all API calls are logged and the logs are immutable.

Exam trap

The trap here is that candidates often confuse log file validation (integrity checks) with immutability (prevention of deletion/modification), or assume that versioning alone provides sufficient protection against log tampering, when in fact only Object Lock in Compliance mode enforces true WORM immutability.

Practice this question →
92
MCQmedium

Refer to the exhibit. A security engineer ran this AWS CLI command to find when a specific CreateKeyPair API call was made. The command returns no results, even though the engineer knows the call was made. What is the MOST likely reason?

A.The time range is too narrow.
B.The command did not specify a region, so it defaults to us-east-1, but the call was made in a different region.
C.The event name should be 'CreateKeypair' (lowercase p).
D.The --lookup-attributes parameter has incorrect syntax.
AnswerD

The comma should be a space or the syntax is wrong.

Why this answer

The `--lookup-attributes` parameter requires a JSON structure with an `AttributeKey` and `AttributeValue`. The provided syntax `--lookup-attributes EventName=CreateKeyPair` is invalid; the correct format is `--lookup-attributes AttributeKey=EventName,AttributeValue=CreateKeyPair`. This malformed parameter causes the AWS CLI to fail silently or return no results, even though the API call exists.

Exam trap

The trap here is that candidates assume the `--lookup-attributes` parameter accepts simple key=value syntax like other AWS CLI commands, but CloudTrail requires a specific `AttributeKey` and `AttributeValue` pair, and failing to use this correct structure silently returns no results instead of an error.

How to eliminate wrong answers

Option A is wrong because the time range is specified as `--start-time` and `--end-time` covering a 24-hour window, which is not too narrow for a known call made within that period. Option B is wrong because the `aws cloudtrail lookup-events` command does not require a `--region` flag; it defaults to the region configured in the AWS CLI profile, and the engineer would have received an error or empty results if the region mismatch caused no events, but the command returns no results at all, not an error. Option C is wrong because the event name in CloudTrail is case-sensitive and stored as `CreateKeyPair` (capital P), matching the command; using lowercase 'p' would actually cause a mismatch, but the command uses correct casing.

Practice this question →
← PreviousPage 2 of 2 · 92 questions total

Ready to test yourself?

Try a timed practice session using only Security Logging questions.

Start 20-question session