Task 4.4: Prepare Logs for Audit DEA-C01 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A data engineer needs to design a centralized log aggregation strategy where audit logs from multiple AWS accounts are stored in a single Amazon S3 bucket for long-term retention and analysis. Which AWS service can be used to deliver logs from multiple accounts to a central S3 bucket?

   • AAWS Organizations
   • BAWS CloudWatch Logs
   • CAWS CloudTrail
   • DAmazon S3 server access logs
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A data engineer wants to detect if any CloudTrail log files have been modified or deleted after they were delivered to Amazon S3. Which AWS feature can be used to validate the integrity of CloudTrail log files?

   • AAWS Config
   • BCloudTrail log file integrity validation
   • CS3 Object Lock
   • DS3 server access logs
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A data governance team must generate a monthly report of all IAM users who accessed a specific S3 bucket, including the time of access and the action performed. The CloudTrail logs are stored in an S3 bucket in a compressed format. Which approach is most efficient for querying this data?

   • AUse AWS CloudWatch Logs Insights to query the CloudTrail logs if they are streamed to CloudWatch Logs.
   • BEnable S3 server access logging on the bucket and query those logs with Amazon QuickSight.
   • CDownload the CloudTrail logs to a local machine and use a spreadsheet application to filter the data.
   • DUse Amazon Athena to query the CloudTrail logs directly in S3 using SQL.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security engineer wants to be notified when an IAM user attempts to access an S3 bucket that they do not have permissions for. The engineer has enabled CloudTrail for the account. What is the most direct way to set up this alert?

   • ACreate an Amazon EventBridge rule that matches CloudTrail API calls with an error code of 'AccessDenied' and triggers an SNS notification.
   • BEnable S3 server access logging on the bucket and use Amazon Athena to query for '403' status codes daily.
   • CSet up an AWS Config rule to check for S3 bucket policies and trigger an SNS notification when a policy changes.
   • DConfigure AWS CloudTrail Insights to detect unusual API activity and send alerts via email.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A healthcare company must demonstrate to regulators that it can track who accessed patient data stored in Amazon S3. The company already uses AWS CloudTrail for management events. What additional step is required to meet this audit requirement?

   • AEnable Amazon GuardDuty to monitor for suspicious activity on the S3 buckets.
   • BEnable CloudTrail data events for the S3 buckets that contain patient data.
   • CEnable S3 server access logs on the patient data buckets.
   • DEnable AWS Config to record S3 bucket configuration changes.
   Reveal Solution Discussion Select an answer first