Task 4.4: Prepare Logs for Audit DEA-C01 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A company is required to retain audit logs for seven years to meet regulatory compliance. After seven years, the logs must be permanently deleted. Which AWS feature should be used to automate the deletion of logs after the retention period?

   • AS3 Object Lock
   • BAWS CloudTrail
   • CAWS Config
   • DS3 Lifecycle policy
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A company must retain records of all data access to its Amazon S3 buckets to meet regulatory requirements. What is the primary compliance driver for maintaining these audit logs?

   • ATo improve the performance of Amazon Athena queries against the S3 data
   • BTo enable real-time data replication to a secondary AWS Region
   • CTo demonstrate compliance with regulations that require organizations to monitor and document access to sensitive data
   • DTo reduce storage costs by identifying infrequently accessed objects
   Reveal Solution Discussion Select an answer first
4. 3expert · medium

   A company has a multi-account AWS environment managed through AWS Organizations. The security team needs to enable CloudTrail for all accounts, including future accounts, and deliver logs to a central S3 bucket. They also need to ensure that only the security team can access the logs. What is the most efficient configuration?

   • AUse AWS CloudFormation StackSets to deploy CloudTrail in each account and deliver logs to a central S3 bucket.
   • BCreate an organization trail in the management account and configure the central S3 bucket with a bucket policy that grants read-only access to the security team.
   • CEnable CloudTrail in the management account only and use AWS Config to aggregate logs from other accounts.
   • DCreate a CloudTrail trail in each account and deliver logs to a central S3 bucket using S3 replication.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company runs a data analytics platform on AWS and needs to collect audit logs from multiple sources, including CloudTrail, VPC Flow Logs, and application logs from EC2 instances. They want a centralized solution that supports real-time monitoring and alerting. Which approach should they use?

   • AConfigure each service to send logs to a different S3 bucket and use S3 Event Notifications to trigger Lambda functions for alerting.
   • BUse Amazon Kinesis Data Firehose to deliver all logs to Amazon OpenSearch Service.
   • CStore all logs in Amazon S3 and use Amazon Athena for querying.
   • DStream all logs to Amazon CloudWatch Logs and use CloudWatch Logs Insights and alarms.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A data engineer needs to capture detailed records of every GET and PUT request made to objects in an Amazon S3 bucket. Which audit log source should they enable?

   • AAmazon S3 server access logs
   • BAWS CloudWatch Logs
   • CAWS CloudTrail data events
   • DAWS Trusted Advisor
   Reveal Solution Discussion Select an answer first