SCS-C02 · Question #307
Your company has mandated that all calls to the AWS KMS service be recorded. How can this be achieved?
The correct answer is B. Enable a trail in Cloudtrail. The AWS Documentation states the following AWS KMS is integrated with CloudTrail, a service that captures API calls made by or on behalf of AWS KMS in your AWS account and delivers the log files to an Amazon S3 bucket that you specify. CloudTrail captures API calls from the AWS…
Question
Your company has mandated that all calls to the AWS KMS service be recorded. How can this be achieved?
Options
- AEnable logging on the KMS service
- BEnable a trail in Cloudtrail
- CEnable Cloudwatch logs
- DUse Cloudwatch metrics
How the community answered
(29 responses)- A10% (3)
- B83% (24)
- C3% (1)
- D3% (1)
Explanation
The AWS Documentation states the following AWS KMS is integrated with CloudTrail, a service that captures API calls made by or on behalf of AWS KMS in your AWS account and delivers the log files to an Amazon S3 bucket that you specify. CloudTrail captures API calls from the AWS KMS console or from the AWS KMS API. Using the information collected by CloudTrail, you can determine what request was made, the source IP address from which the request was made, who made the request when it was made, and so on. Option A is invalid because logging is not possible in the KMS service Option C and D are invalid because Cloudwatch cannot be used to monitor API calls https://docs.aws.amazon.com/kms/latest/developerguide/loeeing-usine-cloudtrail.html
Topics
Community Discussion
No community discussion yet for this question.