Back to AWS CloudTrail

Event History

5 minutes 5 Questions

Event history in AWS CloudTrail is a searchable record of the last 90 days of API activity within your AWS account. It provides insights into the management activities performed by users, roles, or services. You can access the event history from the AWS Management Console, AWS CLI, or the CloudTrai…

Test mode:
Start practice test
AWS Certified Solutions Architect - Event History Example Questions

Test your knowledge of Event History

Question 1

A Solutions Architect needs to review EC2 API activity for a client's AWS account. What source does the Architect use to view the API events?

Correct Answer: AWS CloudTrail Event History.

AWS CloudTrail Event History provides visibility into API activity for your account. Amazon S3 access logs, VPC Flow Logs, EC2 Instance Metadata, Amazon CloudWatch custom metrics, and AWS Config are not the correct sources to view API events for EC2 instances.

Question 2

While analyzing the CloudTrail Event History, an administrator found an unauthorized 'DeleteBucket' event. What security improvements should be made to prevent such events from occurring again?

Correct Answer: Implement the least privilege principle for IAM policies.

Least privilege principle for IAM policies allows to limit the access rights for users to the minimum necessary to perform their job, preventing unauthorized actions. Disabling CloudTrail, converting to a Glacier vault, enabling Object Lock, server-side encryption or S3 bucket versioning would not specifically prevent a DeleteBucket event.

Question 3

AWS CloudTrail shows multiple ConsoleLogin events with Failed authentication from unfamiliar IP addresses. What is the most appropriate immediate action to protect the environment?

Correct Answer: Analyze the IP addresses and block unauthorized access.

CloudTrail records AWS account activity, including ConsoleLogin events. Multiple failed login attempts from unfamiliar IP addresses indicate a potential brute-force or unauthorized access attempt. The appropriate immediate action is to analyze the source IPs and block them using controls such as AWS WAF, security groups, network ACLs, or conditional IAM policies. This mitigates the active threat while you also enable/verify MFA, rotate credentials, and review CloudTrail for further anomalies. Turning off CloudTrail or deleting events removes critical audit evidence and reduces visibility, and changing an EC2 instance's VPC does not address account-level login attempts.

More Event History questions
15 questions (total)
Start 15 question test