CloudTrail for API auditing in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Understanding CloudTrail Event Delivery

When AWS CloudTrail records API activity, how soon after an API call is the event typically delivered to the S3 bucket configured as the trail's destination?

A Within a few minutes, usually less than 15 minutes

B Immediately, in real-time as the API call happens

C Only when manually triggered by the user

D After 24 hours, as a daily batch process

💡 Hint

Think about how logs are usually processed and delivered in cloud services.

CloudTrail delivers recorded API events to the configured S3 bucket within a few minutes, typically less than 15 minutes after the API call. It is not real-time but near real-time.

❓ security

intermediate

CloudTrail Log File Integrity Validation

What is the purpose of enabling log file integrity validation in AWS CloudTrail?

A To encrypt log files before storing them in S3

B To verify that log files have not been altered or deleted after delivery

C To compress log files to save storage space

D To automatically delete old log files after 90 days

💡 Hint

Think about how to ensure logs remain trustworthy after they are saved.

Log file integrity validation helps verify that the log files have not been changed or deleted after CloudTrail delivered them to the S3 bucket, ensuring the logs' trustworthiness.

❓ Architecture

advanced

Designing Multi-Region CloudTrail for Compliance

You need to audit API activity across multiple AWS regions for compliance. Which CloudTrail setup ensures all regions are covered and logs are consolidated in one S3 bucket?

A Create separate trails in each region, each delivering logs to different S3 buckets

B Use CloudWatch Logs instead of CloudTrail for multi-region auditing

C Create a single multi-region trail that applies to all regions and delivers logs to one S3 bucket

D Enable CloudTrail only in the primary region and assume it covers others automatically

💡 Hint

Consider how CloudTrail can be configured to cover all regions with minimal setup.

A single multi-region trail records API activity in all AWS regions and delivers logs to one S3 bucket, simplifying management and ensuring full coverage.

✅ Best Practice

advanced

Securing CloudTrail Logs with Encryption and Access Control

Which combination of settings best protects CloudTrail logs stored in S3 from unauthorized access?

A Store logs in an unencrypted S3 bucket with no access restrictions

B Disable encryption but enable versioning on the S3 bucket

C Use public read access on the S3 bucket for easy log sharing

D Enable S3 bucket encryption with AWS KMS and apply a bucket policy restricting access to CloudTrail service and authorized users

💡 Hint

Think about how to keep logs confidential and prevent unauthorized viewing or tampering.

Encrypting logs with AWS KMS and restricting bucket access ensures logs are protected from unauthorized access and tampering.

🧠 Conceptual

expert

CloudTrail Event Selectors and Data Events

Which statement correctly describes the difference between management events and data events in AWS CloudTrail?

A Management events record operations on AWS resources like creating or deleting, while data events record resource-level operations like reading or writing objects in S3 or Lambda function invocations

B Data events record only failed API calls, management events record successful calls

C Management events are stored only in CloudWatch Logs, data events only in S3

D Data events are free, management events incur additional charges

💡 Hint

Think about what kinds of actions happen at the resource level versus the management level.

Management events capture control plane operations like creating or deleting resources. Data events capture resource-level operations such as reading or writing S3 objects or invoking Lambda functions.