Be able to determine later who deleted a virtual machine and when.
Which countermeasure is effective?
Enable audit logs for management APIs and consoles and preserve them in a tamper-resistant location with individual accounts.
Detailed explanation
Incorrect. A shared administrator account prevents attribution.
Incorrect. A shared administrator account prevents attribution.
Incorrect. Logs stored only on a temporary instance disk may disappear with the instance.
Incorrect. Logs stored only on a temporary instance disk may disappear with the instance.
Incorrect. Omitting deletion logs fails the traceability requirement.
Incorrect. Omitting deletion logs fails the traceability requirement.
Correct. Recording the actor, time, and operation supports later investigation.
Correct. Recording the actor, time, and operation supports later investigation.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s\n' 'actor, time, action, and resource are auditable'Expected result
actor, time, action, and resource are auditableKey points
- Audit log
- Individual accounts
- Log preservation
Notes
- Environment: クラウド監査の概念確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.