AWS Certified Cloud Practitioner (CLF-C02)Security and ComplianceHard
A security engineer wants AWS CloudTrail to automatically detect unusual patterns in API call volume, such as a sudden spike in IAM policy deletion calls, and generate distinct events to flag for investigation. Which CloudTrail feature provides this capability?
- ACloudTrail Management Events
- BCloudTrail Insights
- CCloudTrail Data Events
- DCloudTrail Log File Integrity Validation
Show answer & explanationAnswer & explanation
Correct answer: B. CloudTrail Insights
CloudTrail Insights automatically analyzes management event activity to detect unusual API call volume or error rate patterns and generates Insight events for anomalies. Data Events log object-level operations, Log File Integrity Validation verifies logs haven't been tampered with, and Management Events simply record control-plane API activity without anomaly detection.
Why the other options are wrong
- A. Management Events record control-plane calls but don't analyze them for anomalies.
- C. Data Events log resource-level operations like S3 object access, not anomaly detection.
- D. Log File Integrity Validation checks log tampering, not usage anomalies.
CloudTrail Insights
A CloudTrail feature that uses machine learning to detect unusual API call volume or error rate patterns and generates Insight events for investigation.
- Analyzes management event activity for anomalies like spikes or drops
- Must be explicitly enabled on a trail (incurs additional cost)
- Insight events appear in the CloudTrail console and can trigger alerts via EventBridge
Memory trick: Insights is CloudTrail's alarm bell for weird spikes in API calls.