During a Recent Internal Investigation, It Was Discovered That All

question 245

Multiple Choice

During a recent internal investigation, it was discovered that all API logging was disabled in a production account, and the root user had created new API keys that appear to have been used several times. What could have been done to detect and automatically remediate the incident?

• A) Using Amazon Inspector, review all of the API calls and configure the inspector agent to leverage SNS topics to notify security of the change to AWS CloudTrail, and revoke the new API keys for the root user.
• B) Using AWS Config, create a config rule that detects when AWS CloudTrail is disabled, as well as any calls to the root user create-api-key. Then use a Lambda function to re-enable CloudTrail logs and deactivate the root API keys.
• C) Using Amazon CloudWatch, create a CloudWatch event that detects AWS CloudTrail deactivation and a separate Amazon Trusted Advisor check to automatically detect the creation of root API keys. Then use a Lambda function to enable AWS CloudTrail and deactivate the root API keys.
• D) Using Amazon CloudTrail, create a new CloudTrail event that detects the deactivation of CloudTrail logs, and a separate CloudTrail event that detects the creation of root API keys. Then use a Lambda function to enable CloudTrail and deactivate the root API keys.

---

Definitions:

Coefficient of Correlation

A statistical measure that computes the strength and direction of a linear relationship between two variables.

Direction

The course along which someone or something moves, or a particular position or orientation regarding space or time.

Coefficient of Correlation

A numerical measure that denotes the strength and direction of a linear relationship between two variables.

Linear Relationship

describes a direct proportionality between two variables, meaning as one variable increases or decreases, the other does so in a constant rate.