In cloud-native threat hunting, which AWS service's logs are essential for analysis?

Question

Options

• AAmazon EC2
• BAWS CloudTrail
• CAmazon Simple Storage Service (S3)
• DAWS Lambda

• B
  86% (18)
• C
  5% (1)
• D
  10% (2)

Explanation

AWS CloudTrail is the cornerstone of cloud-native threat hunting because it records all API calls and account activity across your AWS environment - who did what, when, from where, and with what result. This audit trail is indispensable for detecting unauthorized access, privilege escalation, data exfiltration attempts, and other malicious behaviors.

Why the distractors are wrong:

• A (EC2): EC2 is a compute service, not a logging service. Its instance-level logs (OS logs, application logs) can supplement an investigation but don't capture the API-level control plane activity that threat hunters need.
• C (S3): S3 is object storage. Server access logs exist but only show bucket-level HTTP requests - far too narrow. Notably, CloudTrail logs S3 data events when configured.
• D (Lambda): Lambda execution logs go to CloudWatch, not a dedicated threat-hunting service. Lambda activity is itself recorded by CloudTrail.

Memory tip: Think "Trail = Trail of evidence." CloudTrail leaves a trail of every API action in your AWS account - it's the detective's notebook for cloud forensics. If an attacker touches AWS, CloudTrail saw it.

No community discussion yet for this question.