CloudTrail for API auditing in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Understanding CloudTrail Event Delivery

When AWS CloudTrail records API activity, how soon after an API call is the event typically delivered to the S3 bucket configured as the trail's destination?

A Within a few minutes, usually less than 15 minutes

B Immediately, in real-time as the API call happens

C Only when manually triggered by the user

D After 24 hours, as a daily batch process

💡 Hint

Think about how logs are usually processed and delivered in cloud services.

CloudTrail delivers recorded API events to the configured S3 bucket within a few minutes, typically less than 15 minutes after the API call. It is not real-time but near real-time.

❓ security

intermediate

CloudTrail Log File Integrity Validation

What is the purpose of enabling log file integrity validation in AWS CloudTrail?

A To encrypt log files before storing them in S3

B To verify that log files have not been altered or deleted after delivery

C To compress log files to save storage space

D To automatically delete old log files after 90 days

💡 Hint

Think about how to ensure logs remain trustworthy after they are saved.

Log file integrity validation helps verify that the log files have not been changed or deleted after CloudTrail delivered them to the S3 bucket, ensuring the logs' trustworthiness.

❓ Architecture

advanced

Designing Multi-Region CloudTrail for Compliance

You need to audit API activity across multiple AWS regions for compliance. Which CloudTrail setup ensures all regions are covered and logs are consolidated in one S3 bucket?

A Create separate trails in each region, each delivering logs to different S3 buckets

B Use CloudWatch Logs instead of CloudTrail for multi-region auditing

C Create a single multi-region trail that applies to all regions and delivers logs to one S3 bucket

D Enable CloudTrail only in the primary region and assume it covers others automatically

💡 Hint

Consider how CloudTrail can be configured to cover all regions with minimal setup.

A single multi-region trail records API activity in all AWS regions and delivers logs to one S3 bucket, simplifying management and ensuring full coverage.

✅ Best Practice

advanced

Securing CloudTrail Logs with Encryption and Access Control

Which combination of settings best protects CloudTrail logs stored in S3 from unauthorized access?

A Store logs in an unencrypted S3 bucket with no access restrictions

B Disable encryption but enable versioning on the S3 bucket

C Use public read access on the S3 bucket for easy log sharing

D Enable S3 bucket encryption with AWS KMS and apply a bucket policy restricting access to CloudTrail service and authorized users

💡 Hint

Think about how to keep logs confidential and prevent unauthorized viewing or tampering.

Encrypting logs with AWS KMS and restricting bucket access ensures logs are protected from unauthorized access and tampering.

🧠 Conceptual

expert

CloudTrail Event Selectors and Data Events

Which statement correctly describes the difference between management events and data events in AWS CloudTrail?

A Management events record operations on AWS resources like creating or deleting, while data events record resource-level operations like reading or writing objects in S3 or Lambda function invocations

B Data events record only failed API calls, management events record successful calls

C Management events are stored only in CloudWatch Logs, data events only in S3

D Data events are free, management events incur additional charges

💡 Hint

Think about what kinds of actions happen at the resource level versus the management level.

Management events capture control plane operations like creating or deleting resources. Data events capture resource-level operations such as reading or writing S3 objects or invoking Lambda functions.

Practice

1. What is the primary purpose of AWS CloudTrail?

easy

A. To manage user permissions and roles

B. To store website files and images

C. To record API calls for auditing and security

D. To monitor server CPU usage

Solution

1. Step 1: Understand CloudTrail's role

   CloudTrail is designed to record all API calls made in an AWS account for auditing and security purposes.

2. Step 2: Compare other options

   The other options describe other AWS services or functions unrelated to CloudTrail's main purpose.

3. Final Answer:

   To record API calls for auditing and security -> Option C

4. Quick Check:

   CloudTrail = API call recording [OK]

Hint: CloudTrail tracks API calls, not files or CPU [OK]

Common Mistakes:

• Confusing CloudTrail with S3 storage
• Thinking CloudTrail manages permissions
• Assuming CloudTrail monitors server health

2. Which AWS service is used to store CloudTrail logs?

easy

A. Amazon S3

B. Amazon EC2

C. Amazon RDS

D. AWS Lambda

Solution

1. Step 1: Identify CloudTrail log storage

   CloudTrail stores its logs in an Amazon S3 bucket that you specify during setup.

2. Step 2: Eliminate other services

   Amazon EC2 is for virtual servers, RDS is for databases, and Lambda runs code; none store CloudTrail logs.

3. Final Answer:

   Amazon S3 -> Option A

4. Quick Check:

   CloudTrail logs go to S3 buckets [OK]

Hint: CloudTrail logs always go to S3 buckets [OK]

Common Mistakes:

• Choosing EC2 as storage
• Confusing Lambda with log storage
• Selecting RDS for logs

3. Given this CloudTrail event selector configuration:

{"ReadWriteType": "WriteOnly"}

Which API calls will CloudTrail log?

medium

A. Only read API calls

B. Only write API calls

C. Both read and write API calls

D. No API calls

Solution

1. Step 1: Understand ReadWriteType setting

   The "WriteOnly" setting means CloudTrail logs only API calls that change resources (write operations).

2. Step 2: Interpret options

   This logs only write API calls. Read-only and both read/write options include read calls, which are excluded. 'No API calls' means no logging, which is incorrect.

3. Final Answer:

   Only write API calls -> Option B

4. Quick Check:

   WriteOnly = write calls logged [OK]

Hint: WriteOnly logs only changes, not reads [OK]

Common Mistakes:

• Confusing WriteOnly with ReadOnly
• Assuming both read and write are logged
• Thinking no calls are logged

4. You configured CloudTrail but notice no logs are delivered to your S3 bucket. What is a likely cause?

medium

A. CloudTrail only logs read API calls by default

B. CloudTrail does not support logging API calls

C. CloudTrail logs are stored in EC2 instances by default

D. The S3 bucket policy blocks CloudTrail from writing logs

Solution

1. Step 1: Check S3 bucket permissions

   If the bucket policy blocks CloudTrail, logs cannot be delivered, causing no logs to appear.

2. Step 2: Eliminate incorrect causes

   CloudTrail does support logging API calls, logs are not stored on EC2 instances by default, and it logs both read and write API calls by default (not only read).

3. Final Answer:

   The S3 bucket policy blocks CloudTrail from writing logs -> Option D

4. Quick Check:

   Bucket policy must allow CloudTrail writes [OK]

Hint: Check S3 bucket policy if logs don't appear [OK]

Common Mistakes:

• Assuming CloudTrail logs to EC2
• Thinking CloudTrail doesn't log API calls
• Believing default logs are read-only

5. You want to audit only management events for your AWS account using CloudTrail. Which configuration should you use?

hard

A. Enable CloudTrail with event selectors set to log only management events

B. Enable CloudTrail with logging only data events on S3 buckets

C. Disable CloudTrail and use CloudWatch logs instead

D. Enable CloudTrail with event selectors set to log only read-only events

Solution

1. Step 1: Understand management events

   Management events track control plane operations like creating or deleting resources.

2. Step 2: Select correct event selector

   Setting event selectors to log only management events ensures auditing of these API calls.

3. Step 3: Eliminate other options

   Enable CloudTrail with logging only data events on S3 buckets logs data events, not management events. Disable CloudTrail and use CloudWatch logs instead disables CloudTrail, losing audit logs. Enable CloudTrail with event selectors set to log only read-only events logs only read-only events, missing write management events.

4. Final Answer:

   Enable CloudTrail with event selectors set to log only management events -> Option A

5. Quick Check:

   Management events = control plane API logs [OK]

Hint: Use event selectors to log management events only [OK]

Common Mistakes:

• Confusing data events with management events
• Disabling CloudTrail thinking CloudWatch suffices
• Logging only read-only events misses writes