AWS CloudTrail

Question 1

What is AWS CloudTrail?

Answer 1

AWS CloudTrail is a service that enables governance, compliance, operational auditing and risk auditing of your AWS account by logging continuously monitoring and retaining account activity related to actions across AWS infrastructure.

Question 2

What types of events does CloudTrail capture?

Answer 2

CloudTrail captures management events (operations on resources) and data events (resource operations like S3 object-level API calls or Lambda function invocations).

Question 3

What is the default behavior of CloudTrail when first enabled?

Answer 3

By default CloudTrail records management events for the last 90 days in the AWS Management Console but to store logs long-term you must create a trail to an S3 bucket.

Question 4

What is a trail in AWS CloudTrail?

Answer 4

A trail is a configuration that enables delivery of CloudTrail events to an Amazon S3 bucket and optionally to CloudWatch Logs or EventBridge.

Question 5

Can a single trail log events from multiple AWS regions?

Answer 5

Yes. Trails can be multi-region capturing events from all regions or single-region.

Question 6

What are the main destinations for CloudTrail logs?

Answer 6

Amazon S3 (for storage) Amazon CloudWatch Logs (for real-time monitoring) and Amazon EventBridge (for event-driven responses).

Question 7

What is the difference between management events and data events?

Answer 7

Management events are operations like creating or deleting an EC2 instance IAM changes etc. Data events are operations on specific resources such as S3 object-level API calls or Lambda function execution logs.

Question 8

Are data events logged by default?

Answer 8

No, data events must be explicitly enabled on a trail.

Question 9

What is an example of a read-only and write management event?

Answer 9

Read-only: DescribeInstances ListBuckets. Write: CreateBucket TerminateInstances.

Question 10

How can CloudTrail logs be analyzed in near real-time?

Answer 10

By integrating CloudTrail with Amazon CloudWatch Logs to create metrics alarms or EventBridge for automated responses.

Question 11

How does CloudTrail integrate with AWS Organizations?

Answer 11

You can create an organization trail to log events for all accounts in the organization automatically.

Question 12

Can CloudTrail be used for compliance audits?

Answer 12

Yes, it provides immutable time-stamped logs of all AWS API calls which are crucial for compliance audits (e.g. PCI DSS; HIPAA; SOC 2). Integration

Question 13

How can CloudTrail logs be secured?

Answer 13

Enable S3 bucket encryption (SSE-S3 or SSE-KMS) enable log file validation to detect tampering use IAM policies to restrict access enable multi-region trails to prevent gaps in logging.

Question 14

What is CloudTrail log file validation?

Answer 14

It creates a hash chain for log files that allows verification that logs have not been altered or deleted.

Question 15

How long can CloudTrail store logs?

Answer 15

Logs are retained in S3 indefinitely or as per your lifecycle policy.

Question 16

You need to monitor S3 object-level API activity across multiple accounts in your AWS Organization. Which CloudTrail feature should you use?

Answer 16

Create an organization trail and enable data events for the S3 buckets.

Question 17

A CloudTrail trail is sending logs to an S3 bucket. You want to trigger an alert if someone deletes a bucket. How would you do this?

Answer 17

Integrate CloudTrail with EventBridge or CloudWatch Logs to trigger alarms for DeleteBucket API events.

Question 18

How do you ensure that CloudTrail continues logging even if an attacker deletes your trail?

Answer 18

Enable multi-region trails and use AWS Organizations to centrally manage trails; enable log file validation and apply S3 bucket policies to prevent deletion.

Question 19

Default logs in CloudTrail

Answer 19

Management events for 90 days

Question 20

Multi-region trail

Answer 20

Captures all regions prevents gaps

Question 21

Data events

Answer 21

Must be explicitly enabled (S3 objects Lambda)

Question 22

Real-time analysis

Answer 22

CloudWatch Logs EventBridge

Question 23

Log security

Answer 23

SSE KMS log validation IAM policies

Question 24

Organization trail

Answer 24

Logs for all accounts in AWS Organization