Logging and Monitoring

Question 1

Does Cloudtrail log RDP and SSH sessions ?

Answer 1

No

Question 2

What three activities does cloud trail enable ?

Answer 2

• After the fact investigation
• Near Real Time Intrusion Detection
• Industry and Regulatory Compliance

Question 3

What is logged by Cloudtrail

Answer 3

1. Metadata around API Calls
2. Identity of API Caller
3. Time of API Call
4. Source IP Address of Caller
5. Request Parameters
6. Response

Question 4

Who manages the retention of the Cloudtrail S3 bucket ?

Answer 4

You

Question 5

What is the potential delay in delivering Cloud trail results to the S3 bucket ?

Answer 5

15 mins

Question 6

Can Cloudtrail logs be aggregated across accounts ?

Answer 6

yes

Question 7

What management events options are available when setting up Cloudtrail

Answer 7

1. All
2. Read
3. Write

Question 8

What are the Data Events options available to setting up Cloudtrail ?

Answer 8

The ability to see changes to S3 individual data items

Question 9

When setting up cloudtrail what are the advanced settings available to you ?

Answer 9

• Encryption
• Log File Prefix
• Encryption Validation
• SNS for Log file Delivery

Question 10

How do you validate cloudtrail logs ?

Answer 10

By using the digest files

Question 11

Why should you consider protecting your cloud trail logs ?

Answer 11

Cloudtrail logs can contain PII data as well as confidential configuration data

Question 12

How can you protect cloudtrail data

Answer 12

IAM Bucket policies to restrict who has access and then SSE-S3 or SSE-KMS encryption

Question 13

What AWS Managed policies are there for CloudTrail ?

Answer 13

FullAccess and ReadOnly

Question 14

What are the three main elements of CloudWatch ?

Answer 14

Events, Logs and Cloudwatch itself

Question 15

What are the main elements of Cloudwatch ?

Answer 15

1. Realtime
2. Metrics
3. Alarms
4. Notifications
5. Custom Metrics

Question 16

Can Cloudwatch store custom application logs ?

Answer 16

Yes

Question 17

What are the two types of Events we can create ?

Answer 17

Scheduled and Event Pattern

Question 18

What are the two main differences between AWS Config and Prowler ?

Answer 18

Historical analysis replay and remediation

Question 19

What are Config custom rules ?

Answer 19

Rules that can be written that can interact with AWS Lambda

Question 20

What is a config conformance pack ?

Answer 20

A yaml collection of rules that can be deployed as a single unit

Question 21

What are the three options for AWS Config aggregators ?

Answer 21

Multiple Accounts Multiple Regions

Single account multiple regions

Org all accounts