DeleteObject calls suddenly increase above the normal pattern.
Notify operators automatically rather than reviewing logs only after the fact.
Which audit-log approach is most appropriate?
Enable CloudTrail Insights and send generated events to EventBridge for a response workflow.
Detailed explanation
A short-lived spike would be detected too late.
A short-lived spike would be detected too late.
The service identifies unusual API activity and can trigger notification or containment.
The service identifies unusual API activity and can trigger notification or containment.
Removing evidence hides the activity instead of detecting it.
Removing evidence hides the activity instead of detecting it.
CPU usage does not represent API behavior.
CPU usage does not represent API behavior.
Check official documentation
Compare the following points with the official documentation.
AWS CloudTrail Insights、EventBridge CloudTrail events、anomaly detectionの公式説明を確認する。
What to confirm
定期集計と異常API活動の自動検知の違いを説明できる。
Key points
- CloudTrail Insights
- Anomaly detection
- EventBridge
- DeleteObject
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Baseline
Account for legitimate batch spikes and campaigns to reduce false positives.
Containment
Stop an incident from spreading by disabling affected roles or keys while preserving evidence for recovery.