Topic 1 Question 109
The security team depends on AWS CloudTrail to detect sensitive security issues in the company’s AWS account. The DevOps engineer needs a solution to auto-remediate CloudTrail being turned off in an AWS account.
What solution ensures the LEAST amount of downtime for the CloudTrail log deliveries?
Create an Amazon EventBridge rule for the CloudTrail StopLogging event. Create an AWS Lambda function that uses the AWS SDK to call StartLogging on the ARN of the resource in which StopLogging was called. Add the Lambda function ARN as a target to the EventBridge rule.
Deploy the AWS-managed CloudTrail-enabled AWS Config rule, set with a periodic interval of 1 hour. Create an Amazon EventBridge rule for AWS Config rules compliance change. Create an AWS Lambda function that uses the AWS SDK to call StartLogging on the ARN of the resource in which StopLogging was called. Add the Lambda function ARN as a target to the EventBridge rule.
Create an Amazon EventBridge rule for a scheduled event every 5 minutes. Create an AWS Lambda function that uses the AWS SDK to call StartLogging on a CloudTrail trail in the AWS account. Add the Lambda function ARN as a target to the EventBridge rule.
Launch a t2.nano instance with a script running every 5 minutes that uses the AWS SDK to query CloudTrail in the current account. If the CloudTrail trail is disabled, have the script re-enable the trail.
ユーザの投票
コメント(6)
- 正解だと思う選択肢: A
A is correct.
👍 2ParagSanyashiv2023/05/11 A is the right answer
👍 2devnv2023/05/14- 正解だと思う選択肢: A
Answer A, This solution is the most appropriate as it listens to the StopLogging event and automatically starts logging immediately. This approach eliminates the need to wait for a scheduled interval, thereby reducing the amount of downtime and ensuring the security team can detect security issues in real-time.
Option B is incorrect as it uses AWS Config rules to detect CloudTrail stoppage, which might not be an immediate solution to this issue
👍 22pk2023/05/14
シャッフルモード