SCS-C02 · Question #3
A company has a legacy application that runs on a single Amazon EC2 instance. A security audit shows that the application has been using an IAM access key within its code to access an Amazon S3 bucket
The correct answer is C. Use Amazon Athena to query the CloudTrail logs in DOC-EXAMPLE-BUCKET2 for any API calls E. Configure Amazon Macie to identify any objects in DOC-EXAMPLE-BUCKET1 that contain PII. Querying CloudTrail logs with Athena identifies historical S3 API calls, while Macie scans the bucket for sensitive data that may have been exposed.
Question
A company has a legacy application that runs on a single Amazon EC2 instance. A security audit shows that the application has been using an IAM access key within its code to access an Amazon S3 bucket that is named DOC-EXAMPLE-BUCKET1 in the same AWS account. This access key pair has the s3:GetObject permission to all objects in only this S3 bucket. The company takes the application offline because the application is not compliant with the company's security policies for accessing other AWS resources from Amazon EC2. A security engineer validates that AWS CloudTrail is turned on in all AWS Regions. CloudTrail is sending logs to an S3 bucket that is named DOC-EXAMPLE-BUCKET2. This S3 bucket is in the same AWS account as DOC-EXAMPLE-BUCKET1. However, CloudTrail has not been configured to send logs to Amazon CloudWatch Logs. The company wants to know if any objects in DOC-EXAMPLE-BUCKET1 were accessed with the IAM access key in the past 60 days. If any objects were accessed, the company wants to know if any of the objects that are text files (.txt extension) contained personally identifiable information (PII). Which combination of steps should the security engineer take to gather this information? (Choose two.)
Options
- AUse Amazon CloudWatch Logs Insights to identify any objects in DOC-EXAMPLE-BUCKET1 that
- BUse Amazon OpenSearch Service to query the CloudTrail logs in DOC-EXAMPLE-BUCKET2 for
- CUse Amazon Athena to query the CloudTrail logs in DOC-EXAMPLE-BUCKET2 for any API calls
- DUse AWS Identity and Access Management Access Analyzer to identify any API calls that used
- EConfigure Amazon Macie to identify any objects in DOC-EXAMPLE-BUCKET1 that contain PII
How the community answered
(67 responses)- A12% (8)
- B3% (2)
- C81% (54)
- D4% (3)
Why each option
Querying CloudTrail logs with Athena identifies historical S3 API calls, while Macie scans the bucket for sensitive data that may have been exposed.
CloudWatch Logs Insights queries data within CloudWatch Logs log groups. CloudTrail in this scenario is configured to deliver logs to S3, not CloudWatch Logs, so Logs Insights cannot access them.
Amazon OpenSearch Service could technically query CloudTrail logs, but it requires ingesting data into a separate OpenSearch domain first. This is significantly more complex and costly than using Athena to query logs already in S3.
Amazon Athena can run SQL queries directly against CloudTrail log files stored in S3 using a pre-defined table schema. This allows the security engineer to filter for s3:GetObject API calls targeting DOC-EXAMPLE-BUCKET1 and identify which objects were accessed, by whom, and when - all without moving data.
IAM Access Analyzer evaluates current resource policies and identifies unintended external access. It does not provide a historical record of past API calls made using specific credentials.
Amazon Macie uses machine learning to automatically discover and classify sensitive data such as PII within S3 buckets. Running Macie on DOC-EXAMPLE-BUCKET1 identifies whether any accessed objects contained sensitive information, which is essential for determining the scope of potential data exposure.
Concept tested: Athena CloudTrail analysis and Macie PII detection
Source: https://docs.aws.amazon.com/athena/latest/ug/cloudtrail-logs.html
Topics
Community Discussion
No community discussion yet for this question.