Question #883

试题更新时间: 2023-11-07 12:59:45

Your organization has two AWS accounts; one for development and the other for production. Each account has EC2 instances running as web servers, a load balancer, and an RDS database. Your security team has asked you to ensure that they can log all interactions with these AWS services and that users cannot tamper with logs. Which of the following steps should you take? (Choose three)

A. Create a new S3 bucket. Configure CloudTrail in both accounts to log to this bucket.

B. Use the existing S3 buckets in each account. Configure CloudTrail in each account to log to its own S3 bucket.

C. Create a new IAM user policy to control access to the S3 bucket.

D. Create a new IAM role to control access to the S3 bucket.

E. Allow CloudTrail to perform PUT operations, explicitly deny GET operations, and explicitly allow the Security Team to perform GET operations.

F. Allow CloudTrail to perform PUT operations. Allow the Security Team to perform GET operations.

G. Create an S3 Bucket Policy to control access to the S3 bucket.

上一题收藏列表练习记录

下一题点击收藏

问题反馈