Exam AWS Certified Security - Specialty topic 1 question 55 discussion

A is correct answer. Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/. In the navigation pane, choose Logs. In the list of log groups, select the check box next to the log group that you created for CloudTrail log events. Choose Create Metric Filter. On the Define Logs Metric Filter screen, choose Filter Pattern and then type the following: { ($.errorCode = "*UnauthorizedOperation") || ($.errorCode = "AccessDenied*") } Choose Assign Metric. For Filter Name, type AuthorizationFailures. For Metric Namespace, type CloudTrailMetrics. For Metric Name, type AuthorizationFailureCount.

I had this question on my exam today. Correct answer is A

A is the answer. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html

For this question, and answer without mentioning CloudTrail does not sound right. A. could've been the best answer had it mentioned CloudTrail. I know it is enabled by default, but needs a trail toward CloudWatch to be created. https://docs.aws.amazon.com/securityhub/latest/userguide/cloudwatch-controls.html Related requirements: CIS AWS Foundations Benchmark v1.2.0/3.1 Resource type: AWS::Logs::MetricFilter, AWS::CloudWatch::Alarm, AWS::CloudTrail::Trail, AWS::SNS::Topic You can do real-time monitoring of API calls by directing CloudTrail logs to CloudWatch Logs and establishing corresponding metric filters and alarms. The check results in FAILED findings in the following cases: No trail is configured.

Couldn't find anything to suggest CloudTrail can go directly to Kinesis, has to go via S3 first. Multiple articles state that this can be done via CloudWatch, although my instinct would be CloudTrail for API requests. I'd go A

"A" makes sense. The top comment explained very well

A is Correct - You cannot stream CloudTrail to kinesis so B is not the correct answer

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/monitor-cloudtrail-log-files-with-cloudwatch-logs.html the process is described here

A is Correct - You cannot stream CloudTrail to kinesis so B is not correct answer

https://aws.amazon.com/blogs/security/using-cloudtrail-to-identify-unexpected-behaviors-in-individual-workloads/ Activities within your AWS account can be recorded with CloudTrail, which makes it the ideal service not only for deeper investigations into past cloud activities but also to detect unwanted behaviors in near real time. CloudTrail sends logs to an S3 bucket and can forward events to CloudWatch. Using CloudWatch, you can perform searches across all CloudTrail events and define CloudWatch alarms for automatic notifications. You can create alerts for individual CloudTrail events that you consider an anomaly by creating CloudWatch filters and alarms. A filter defines the events that you want to monitor and an alarm defines the threshold when you want to be notified. Anomaly detection in the cloud monitors cloud service activities on the control plane and checks to see if the behavior is expected in the context of each workload

Answer is B. Option A creates an Amazon CloudWatch metric filter that looks for API call error codes and then implements an alarm based on that metric's rate. While this approach can detect when there are too many error codes, it does not take into account unauthorized requests. It only detect errors made by authorized request. It does not provide visibility into the security events that have occurred like unauthorized requests, which is the focus of the question.

A can do it , but B do it better

Recommended and out of the box solution is option A B while possible you need to write LAMBDA code and it requires more effort to build customer solution , so its not preferred for this use case.

Simply voting B to add thinking effort: A: Simplest and not real-time B: Complex and real-time Both are possible, and since the question didn't state the requirement, we should choose the most straightforward way out.

It would be A, if CloudTrail was configured to send logs to Cloud watch, which is disabled by default

A Correct Answer

A is correct answer.