According to Information Security Policy, Changes to the Contents of Objects

question 574

Multiple Choice

According to Information Security Policy, changes to the contents of objects inside production Amazon S3 bucket that contain encrypted secrets should only be made by a trusted group of administrators. How should a DevOps Engineer create real-time, automated checks to meet this requirement?

• A) Create an AWS Lambda function that is triggered by Amazon S3 data events for object changes and that also checks the IAM user's membership in an administrator's IAM role.
• B) Create a periodic AWS Config rule to query Amazon S3 Logs for changes and to check the IAM user's membership in an administrator's IAM role.
• C) Create a metrics filter for Amazon CloudWatch logs to check for Amazon S3 bucket-level permission changes and to check the IAM user's membership in an administrator's IAM role.
• D) Create a periodic AWS Config rule to query AWS CloudTrail logs for changes to the Amazon S3 bucket-level permissions and to check the IAM user's membership in an administrator's IAM role.

---

Definitions:

Capitalized

Refers to recording an expense or cost as an asset on the balance sheet, rather than as an expense on the income statement, to spread out the expense over its useful life.

Long-Lived Assets

These are tangible or intangible assets that a company expects to use for more than one year, including property, plant, and equipment.

Economic Benefits

The gains derived from actions or decisions, typically measured in terms of revenue or income generated or costs saved.

Service Potential

The capacity or capability of an asset, especially a non-financial asset, to provide services or benefits over its useful life.