During a Recent Internal Investigation, It Was Discovered That All

question 245

Multiple Choice

During a recent internal investigation, it was discovered that all API logging was disabled in a production account, and the root user had created new API keys that appear to have been used several times. What could have been done to detect and automatically remediate the incident?

• A) Using Amazon Inspector, review all of the API calls and configure the inspector agent to leverage SNS topics to notify security of the change to AWS CloudTrail, and revoke the new API keys for the root user.
• B) Using AWS Config, create a config rule that detects when AWS CloudTrail is disabled, as well as any calls to the root user create-api-key. Then use a Lambda function to re-enable CloudTrail logs and deactivate the root API keys.
• C) Using Amazon CloudWatch, create a CloudWatch event that detects AWS CloudTrail deactivation and a separate Amazon Trusted Advisor check to automatically detect the creation of root API keys. Then use a Lambda function to enable AWS CloudTrail and deactivate the root API keys.
• D) Using Amazon CloudTrail, create a new CloudTrail event that detects the deactivation of CloudTrail logs, and a separate CloudTrail event that detects the creation of root API keys. Then use a Lambda function to enable CloudTrail and deactivate the root API keys.

---

Definitions:

Higher Education

Post-secondary education provided by universities and colleges, offering a range of academic and professional degrees.

Dynamically Continuous Innovation

Innovations that represent a moderate change to existing products or services, often involving some new features or significant improvements without completely displacing the old ones.

Continuous Innovation

Incremental updates or improvements to a product or service that do not significantly alter consumer behavior but enhance value.

Market Modification

Strategies used by companies to change the characteristics of the marketplace to improve competitiveness and customer appeal.