Quizzes · Service

CloudTrail

Level 0 questions on CloudTrail. Read about it first if it's new to you.

Works with: Organizations (4), Control Tower (3), Config (2), S3 (2), IAM Identity Center (1), RDS (1), IAM (1), CloudWatch Logs (1)

15 questions, from a pool of 20
1 correct answer of 4 each
Pass line 80%

Questions and answers come in a new order every time, and every choice is explained. Your answers feed your weak spots on the exam page; they don't change your exam score.

Question 1Todo.io's auditors require that nobody in the Prod account can ever stop CloudTrail logging. Which control meets the requirement?

An SCP on the Prod OU that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.Correct. "Can ever" asks for a preventive control. An SCP Deny blocks the API call for everyone in the account, administrators and root included.An AWS Config rule that checks CloudTrail is turned on.Not this one. Config is detective: it tells you after logging was stopped. The requirement says it must never happen.A CloudWatch alarm that emails the security team when logging stops.Not this one. An alarm also fires after the fact. Being told isn't the same as preventing it.Remove cloudtrail:StopLogging from every IAM policy in the account.Not this one. Anyone who can edit IAM policies could add it back. An SCP sits outside the account, where they can't change it.

Learn it: SCP (service control policy) · Controls (guardrails) · Set up AWS: Day 0 with Control Tower

Question 2A teammate says that once Todo.io uses Control Tower, it no longer uses AWS Organizations. Which statement is true?

Control Tower sets up and governs Organizations, IAM Identity Center, CloudTrail and Config. It doesn't replace them.Correct. The organization, the OUs and the SCPs are all still there. Control Tower manages them for you.Control Tower replaces Organizations with its own account system.Not this one. Control Tower runs on top of Organizations.Control Tower is only a dashboard; it changes nothing.Not this one. It creates accounts, applies controls and sets up logging and sign-in.Control Tower runs separately inside each member account.Not this one. It runs from the management account and governs the accounts below it.

Learn it: AWS Control Tower

Question 3Why does a Control Tower landing zone keep every account's logs in a separate Log Archive account?

Someone who breaks into a workload account can't erase the evidence of what they did.Correct. Nobody runs apps in the Log Archive account, and workload accounts can't delete what is stored there.Storage is cheaper in a separate account.Not this one. The price of storage doesn't depend on which account holds it.CloudTrail can only write to another account.Not this one. CloudTrail can write to a bucket in the same account. Separating them is a security choice.Logs in workload accounts are deleted after 90 days.Not this one. Logs in S3 are kept as long as you choose, in any account.

Learn it: Landing zone · Set up AWS: Day 0 with Control Tower

Question 4Someone ran DELETE FROM todos on Todo.io's RDS database. Will CloudTrail show who did it?

No. CloudTrail records AWS API calls, not the SQL run inside a database. The database's own logs would show it.Correct. CloudTrail would show CreateDBInstance or DeleteDBInstance, never what happens inside.Yes. CloudTrail records every SQL statement.Not this one. It never sees inside the database.Yes, but only with AWS Config turned on.Not this one. Config records resource settings, not queries.Yes, in CloudWatch metrics.Not this one. Metrics are numbers, such as connections or CPU, not who ran what.

Learn it: RDS (Relational Database Service) · CloudTrail

Question 5Todo.io's auditors ask who downloaded a file from an S3 bucket last week. CloudTrail is on with its default settings. Will it have that?

No. Object reads are data events, which CloudTrail doesn't log by default. They have to be turned on.Correct. By default CloudTrail logs management events, such as creating a bucket, not every object read.Yes. CloudTrail logs every object read by default.Not this one. Only management events are logged by default.Yes, in CloudWatch Logs.Not this one. CloudWatch Logs holds what applications print, not who read an object.No. S3 object reads can never be recorded.Not this one. They can, once CloudTrail data events are turned on.

Learn it: CloudTrail

Question 6Todo.io's staging database was deleted at 3 a.m. last night. Which service shows who deleted it, and from which IP address?

AWS CloudTrailCorrect. CloudTrail records every AWS API call, such as DeleteDBInstance: who made it, when and from where. Even without a trail, Event history keeps 90 days of these.Amazon CloudWatch LogsNot this one. CloudWatch Logs holds what applications print. It doesn't record who called AWS APIs.The database's own query logNot this one. The database is gone, and its logs only see SQL. Deleting a database is an AWS API call, which the database never sees.The VPC route tableNot this one. Route tables decide where traffic goes. They record nothing.

Learn it: CloudTrail · Set up AWS: Create the database

Question 7Todo.io never created a CloudTrail trail. Can it still see who changed a security group yesterday?

Yes. CloudTrail Event history keeps 90 days of management events in each Region, with no setup.Correct. A trail is for keeping events longer, or in one place.No. Nothing is recorded until a trail exists.Not this one. Event history is always on.Only if AWS Config is turned on.Not this one. Config records settings; CloudTrail records who made the call.Only for changes made by the root user.Not this one. Every caller is recorded.

Learn it: CloudTrail

Question 8Todo.io must keep a record of every AWS API call for seven years. What does it need?

A CloudTrail trail that delivers events to an S3 bucket, kept for seven years.Correct. A trail saves events to S3 for as long as you choose. Event history alone stops at 90 days.Set Event history to keep seven years.Not this one. Event history is fixed at 90 days.CloudWatch metrics.Not this one. Metrics are numbers over time, not a record of API calls.AWS Config.Not this one. Config records how resources are set up, not every API call.

Learn it: CloudTrail

Question 9Todo.io wants one trail that records every account and every Region in its organization. What should it create?

An organization trail, from the management account.Correct. One trail covers every account and Region, including accounts added later.A trail in each account, one by one.Not this one. That works, but every new account needs one, and each account could switch its own off.An IAM Identity Center permission set.Not this one. Permission sets give people access; they don't record anything.An SCP.Not this one. SCPs limit what can be done; they record nothing.

Learn it: CloudTrail

Question 10Someone tried to delete Todo.io's audit bucket, and IAM denied it. Does CloudTrail record the attempt?

Yes. CloudTrail records failed calls too, with the error.Correct. Denied attempts are often the most interesting events in an investigation.No. Only successful calls are recorded.Not this one. Failed calls are recorded too.Only if the attempt was made in the console.Not this one. Console, CLI and SDK calls are all recorded.Only if the caller used MFA.Not this one. Every call is recorded, with or without MFA.

Learn it: CloudTrail

Question 11One teammate changes a setting in the console, another with the CLI, and the app with the SDK. Which does CloudTrail record?

All three. They all end up as the same signed AWS API call.Correct. That is why CloudTrail can see everything done to AWS, however it was done.Only the console change.Not this one. The console just makes API calls for you.Only the CLI change.Not this one. The CLI is one of three ways to make the same call.The console and CLI changes, but not the app's.Not this one. SDK calls are API calls too.

Learn it: CloudTrail · Set up AWS: Create the database

Question 12A bucket policy changed overnight. Which service tells Todo.io who changed it?

AWS CloudTrail.Correct. It records the PutBucketPolicy call: who made it, when and from where.AWS Config.Not this one. Config shows what the policy looked like before and after, not who made the call.Amazon CloudWatch Logs.Not this one. Logs hold what applications print.IAM Identity Center.Not this one. Identity Center handles sign-in; it doesn't record API calls.

Learn it: CloudTrail · AWS Config

Question 13An administrator in Todo.io's Dev account tries to turn off the organization trail. What happens?

They can't. Member accounts can see an organization trail but can't change or stop it.Correct. Only the management account (or a delegated administrator) controls the organization trail.It stops for every account in the organization.Not this one. Member accounts can't touch it.It stops, but only for the Dev account.Not this one. Member accounts can't switch it off for themselves either.Only the Dev account's root user can stop it.Not this one. Root in a member account can't change it either.

Learn it: CloudTrail

Question 14What does AWS CloudTrail record?

AWS API calls: who made them, what they did, when, and from where.Correct. "Who did what to AWS" is CloudTrail's answer.What applications print.Not this one. That is CloudWatch Logs.CPU and memory use over time.Not this one. That is CloudWatch metrics.How each resource is configured, over time.Not this one. That is AWS Config.

Learn it: CloudTrail

Question 15Todo.io looks in CloudTrail Event history in us-east-1 for a call made in eu-west-1, and can't find it. Why?

Event history is kept per Region; switch the console to eu-west-1 to see it.Correct. A multi-Region trail collects every Region in one place.Calls made in eu-west-1 aren't recorded.Not this one. They are recorded, in eu-west-1.Event history only records global services.Not this one. It records management events from regional services too.Events are deleted after one day.Not this one. Event history keeps 90 days.

Learn it: CloudTrail · Region

Question 16Can Todo.io's CloudWatch Logs show who deleted the staging database?

No. Deleting a database is an AWS API call, which CloudTrail records. CloudWatch Logs holds what apps print.Correct. Don't mix them up: CloudTrail is who did what to AWS; CloudWatch Logs is what your software said.Yes, always.Not this one. Only if something happened to print it, and AWS API calls are not printed there.Only if the CloudWatch agent is installed.Not this one. The agent ships files from an instance; it doesn't see API calls.Only in CloudWatch metrics.Not this one. Metrics are numbers, not who did what.

Learn it: CloudWatch Logs · CloudTrail

Question 17AWS Config shows that a bucket became public at 14:02. Where should Todo.io look to find out who did it?

CloudTrail, for the call that changed the bucket around 14:02.Correct. Config says what changed and when; CloudTrail says who made the call.AWS Config again; it records the caller.Not this one. Config records the resource's settings, not the caller.CloudWatch Logs.Not this one. App output won't show who called S3.The bucket's object list.Not this one. Objects don't record who changed the bucket's settings.

Learn it: AWS Config · CloudTrail

Question 18What does "CloudTrail" mean?

A record of every AWS API call. Who did what, when, from where.Correct. Think of it as: The building's CCTV and visitor book.Where applications and AWS services send their log lines.Not this one. That describes CloudWatch Logs.Records how your resources are configured over time and checks them against rules.Not this one. That describes AWS Config.Unlimited storage for files ("objects") in containers called buckets.Not this one. That describes S3 (Simple Storage Service).

Learn it: CloudTrail

Question 19Which term is this? "A record of every AWS API call. Who did what, when, from where."

CloudTrailCorrect. Yes. Think of it as: The building's CCTV and visitor book.CloudWatch LogsNot this one. CloudWatch Logs is: Where applications and AWS services send their log lines.AWS ConfigNot this one. AWS Config is: Records how your resources are configured over time and checks them against rules.S3 (Simple Storage Service)Not this one. S3 (Simple Storage Service) is: Unlimited storage for files ("objects") in containers called buckets.

Learn it: CloudTrail

Question 20Which AWS term is described by this analogy? "The building's CCTV and visitor book."

CloudTrailCorrect. Yes: A record of every AWS API call. Who did what, when, from where.CloudWatch LogsNot this one. CloudWatch Logs is: Where applications and AWS services send their log lines. Its analogy: The building's logbook.AWS ConfigNot this one. AWS Config is: Records how your resources are configured over time and checks them against rules. Its analogy: A building inspector with a notebook and a camera.S3 (Simple Storage Service)Not this one. S3 (Simple Storage Service) is: Unlimited storage for files ("objects") in containers called buckets. Its analogy: A warehouse of labelled boxes you can reach from anywhere.

Learn it: CloudTrail

CloudTrail

Worth another look

Your weak spots

Services

Concepts