2026-04-25 09:14:03 iam:AttachRolePolicy user=alice 2026-04-25 09:15:10 ec2:AuthorizeSecurityGroupIngress user=alice 2026-04-25 09:16:22 s3:PutBucketPolicy user=alice Requirement: Security wants to track management-plane API calls and configuration changes across cloud resources.
Based on the exhibit, which logging capability should be enabled first to create an audit trail for cloud administration changes?
Exhibit: 2026-04-25 09:14:03 iam:AttachRolePolicy user=alice 2026-04-25 09:15:10 ec2:AuthorizeSecurityGroupIngress user=alice 2026-04-25 09:16:22 s3:PutBucketPolicy user=alice
Requirement: Security wants to track management-plane API calls and configuration changes across cloud resources.
Answer choices
Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.
Enable cloud control-plane audit logging such as CloudTrail or the provider equivalent.
This is the best choice because the exhibit shows API-level changes to identity, networking, and storage policies. Control-plane audit logging records who made those changes, what action was taken, and when it occurred. That creates the most useful evidence for investigations, change tracking, and compliance in a cloud environment.
Install a rootkit detector on each workload and ignore management-plane activity.
Host-based rootkit detection can help on individual instances, but it does not provide a complete record of cloud configuration changes. The exhibit is specifically about administrative API actions, not malware on a single server.
Capture only DNS traffic, because it reveals all admin changes indirectly.
DNS logs may provide context, but they do not record policy edits, role changes, or security group modifications. They are far too indirect for the stated requirement.
Rely on manual change tickets in a spreadsheet because cloud platforms do not record useful logs.
Manual tickets are useful for process control, but they are not a reliable security log. Cloud platforms do record detailed administrative activity, and that data should be enabled and retained.
Common exam trap
Many certification questions include familiar terms but test a specific constraint. Read the exact wording before choosing an answer that is generally true but wrong for this case.
Technical deep dive
This question should be treated as a scenario, not a definition check. Identify the problem, the constraint and the best action. Then compare each option against those facts.
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise SY0-701 questions linked to Security+ social engineering questions.
Practise SY0-701 questions linked to Security+ cryptography.
Practise SY0-701 questions linked to Security+ IAM questions.
Practise SY0-701 questions linked to Security+ risk management questions.
Practise SY0-701 questions linked to Security+ incident response questions.
Practise SY0-701 questions linked to Security+ malware questions.
Practise SY0-701 questions linked to Security+ vulnerability management questions.
Practise SY0-701 questions linked to Security+ security operations questions.
Practise SY0-701 questions linked to Security+ zero trust questions.
Practise SY0-701 questions linked to Security+ authentication factors questions.
Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.
Question 1
Question 2
Question 3
Question 4
Question 5
Question 6
FAQ
Read the scenario before looking for a memorised answer.
The correct answer is: Enable cloud control-plane audit logging such as CloudTrail or the provider equivalent. — The exhibit contains management-plane actions, such as changing IAM policies, opening security groups, and modifying bucket policies. The right logging capability is the cloud provider's control-plane audit log, because it captures those API calls centrally and tamper-resistant logging can preserve the evidence. That gives the security team a clear audit trail for investigations, change validation, and accountability. Why others are wrong: Option B is workload-focused and misses the platform-level changes shown in the exhibit. Option C is far too indirect to capture configuration changes. Option D relies on process documentation instead of the actual authoritative event records that the cloud already provides.
Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.
Sign in to join the discussion.