DOP-C02 · Question #491
A company has an organization in AWS Organizations. The organization has all features enabled and has AWS CloudTrail trusted access configured for the management account. An Amazon Simple Notification
The correct answer is C. Configure the trail to publish logs to a new Amazon S3 bucket in the audit account and a new. Configure the organization trail to deliver logs to an S3 bucket in the audit account to centralize retention of all organization events across all Regions. Also deliver the same trail events to a CloudWatch Logs log group to enable near real-time detection. A CloudWatch Logs met
Question
A company has an organization in AWS Organizations. The organization has all features enabled and has AWS CloudTrail trusted access configured for the management account. An Amazon Simple Notification Service (Amazon SNS) topic is configured for notifications. The company needs all AWS events in all AWS Regions in the organization to be recorded and retained in an audit account. The company needs near real-time notifications of any failed login attempts. A DevOps engineer has created an organization trail in the management account to log events for all Regions. Which solution will meet these requirements with the LEAST operational effort?
Options
- AConfigure the trail to publish logs to a new Amazon S3 bucket in the audit account. In the audit
- BConfigure the trail to publish logs to a new Amazon S3 bucket in the management account.
- CConfigure the trail to publish logs to a new Amazon S3 bucket in the audit account and a new
- DConfigure the trail to publish logs to a new Amazon CloudWatch log group in the audit account.
How the community answered
(45 responses)- A24% (11)
- B9% (4)
- C60% (27)
- D7% (3)
Explanation
Configure the organization trail to deliver logs to an S3 bucket in the audit account to centralize retention of all organization events across all Regions. Also deliver the same trail events to a CloudWatch Logs log group to enable near real-time detection. A CloudWatch Logs metric filter can identify failed login patterns as events arrive, and a CloudWatch alarm can immediately notify the SNS topic when failed logins occur, with minimal ongoing management.
Topics
Community Discussion
No community discussion yet for this question.