According to Information Security Policy, Changes to the Contents of Objects

question 574

Multiple Choice

According to Information Security Policy, changes to the contents of objects inside production Amazon S3 bucket that contain encrypted secrets should only be made by a trusted group of administrators. How should a DevOps Engineer create real-time, automated checks to meet this requirement?

• A) Create an AWS Lambda function that is triggered by Amazon S3 data events for object changes and that also checks the IAM user's membership in an administrator's IAM role.
• B) Create a periodic AWS Config rule to query Amazon S3 Logs for changes and to check the IAM user's membership in an administrator's IAM role.
• C) Create a metrics filter for Amazon CloudWatch logs to check for Amazon S3 bucket-level permission changes and to check the IAM user's membership in an administrator's IAM role.
• D) Create a periodic AWS Config rule to query AWS CloudTrail logs for changes to the Amazon S3 bucket-level permissions and to check the IAM user's membership in an administrator's IAM role.

---

Definitions:

Abbreviations

Shortened forms of words or phrases used to save space or avoid repetition.

Q.D.

A medical abbreviation for "quaque die," which means once a day; used in prescriptions to indicate the frequency of medication intake.

IU

International Units, a measurement used to quantify vitamins, hormones, some medications, vaccines, and similar biologically active substances.

Coding Clinic

The Coding Clinic provides official guidance, clarification, and examples on the application of coding rules and conventions found in medical classification systems.