A SysOps administrator noticed that a large number of Elastic IP addresses are being created on the company's AWS account, but they are not being associated with Amazon EC2 instance, and are…

Question

Options

• AAttach a cost-allocation tag to each requested Elastic IP address with the IAM user name of the
• BQuery AWS CloudTrail logs by using Amazon Athena to search for Elastic IP address events.
• CCreate a CloudWatch alarm on the EIPCreated metric and send an Amazon SNS notification
• DUse Amazon Inspector to get a report of all Elastic IP addresses created in the last 30 days.

• A
  74% (17)
• B
  13% (3)
• C
  9% (2)
• D
  4% (1)

Explanation

Note: The marked answer (A) appears to be incorrect - the correct answer is B.

Querying AWS CloudTrail logs with Amazon Athena is the right approach because CloudTrail records every API call made in an AWS account, including AllocateAddress (which creates Elastic IPs), along with the IAM identity (user, role, or access key) that made the call. Athena lets you run SQL queries against CloudTrail logs stored in S3 at scale, making it straightforward to filter for EIP creation events and see exactly who triggered them.

Why the distractors are wrong:

• A - Cost-allocation tags identify cost centers, not actors. Tags also require a proactive policy to be applied at creation time; they can't retroactively tell you who created already-existing untagged EIPs, and a bad actor simply wouldn't tag their own resources.
• C - There is no native CloudWatch metric called EIPCreated; CloudWatch doesn't surface EIP allocation as a metric, so this alarm cannot be configured as described.
• D - Amazon Inspector is a vulnerability assessment tool for EC2 workloads; it does not audit or report on resource creation history.

Memory tip: Whenever an exam question asks "who performed an action?" or "who created/modified a resource?", the answer almost always involves CloudTrail - it's AWS's audit log for API activity. Pair it with Athena when you need to query large log volumes.

No community discussion yet for this question.