CloudTrail

Question 1

What is the default data retention period for the CloudTrail service?

Answer 1

90 days

Question 2

Which CloudTrail component allows logs to be delivered to S3, CloudWatch Logs, or CloudWatch Events?

Answer 2

Trail

Question 3

Is CloudTrail a real-time solution?

Answer 3

No, logs usually take up to 15 minutes to deliver

Question 4

In which region are CloudTrail log events recorded for global services such as IAM, SNS, and CloudFront?

Answer 4

These events are logged in the us-east-1 region; only global trails can catch these logs

Question 5

Which types of events does CloudTrail log?

Answer 5

• Management events
• Data events
• Insight events

Question 6

Which type of CloudTrail events provides information known as control plane operations (e.g., resource creation, policy attachment)?

Answer 6

Management events

Question 7

Which type of events does CloudTrail log by default?

Answer 7

Management events only

Question 8

Which type of CloudTrail events provides information known as data plane operations (e.g., object deletion from an S3 bucket, SNS publish)?

Answer 8

Data events

Question 9

Which type of CloudTrail events provides information on UNUSUAL API call rates or error rate activity (e.g., an account typically logs 20 deleteBucket API calls, but starts to log an average of 100 deleteBucket API calls)?

Answer 9

Insight events

Question 10

How can you stop incurring charges for an AWS CloudTrail Trail?

Answer 10

By deleting the trail or temporarily stopping logging

Question 11

What is required for a AWS S3 bucket owner to receive AWS CloudTrail object access logs?

Answer 11

The S3 bucket owner must also be the object owner or have permissions through the object ACL

Question 12

Which AWS CloudTrail feature ensures delivered log files haven’t been modified by generating digitally signed hashes and digest files?

Answer 12

Log file integrity validation

Question 13

What is the purpose of AWS CloudTrail log file integrity validation?

Answer 13

Verify log integrity and detect unauthorized changes

Question 14

How are the digest files used for AWS CloudTrail log integrity validation encrypted?

Answer 14

SSE‑S3 (Amazon S3‑managed encryption keys)

Question 15

Which type of CloudTrail trail collects events from all AWS Organizations member accounts?

Answer 15

Organization trail

Question 16

How can an organization trail deliver logs to an S3 bucket in a member account without additional cross‑account access?

Answer 16

Bucket ARNs must be specified in the trail configuration