AWS Certified Data Engineer - Associate DEA-C01Demo

By Amazon · Question Mode

QuestionQ320

Data Security and Governance

A company has an application that is deployed on AWS. The application uses Amazon Simple Notification Service (Amazon SNS) with multiple topics. The company's security team needs to be able to audit all Publish and PublishBatch API actions for all the SNS topics. The company's application team and security team must also be able to query the audit data. The company has already established an event data store in AWS CloudTrail Lake to collect all events.

Which solution will meet these requirements with the LEAST operational overhead?

  • A Enable management events for the SNS topics. Create a table in AWS Glue Data Catalog. Query the data by using Amazon Athena.
  • B Enable management events for the SNS topics. Use CloudTrail Lake to query the audit data.
  • C Enable data events for the SNS topics. Use CloudTrail Lake to query the audit data.
  • D Enable data events for the SNS topics. Create a table in AWS Glue Data Catalog. Query the data by using Amazon Athena.
Explanation

Publish and PublishBatch are data-plane operations on SNS topics, so CloudTrail must be configured to log data events (not just management events) to capture them. Since the company already has a CloudTrail Lake event data store, querying directly with CloudTrail Lake's built-in SQL-based query capability avoids the added overhead of building a separate Glue Data Catalog table and Athena queries. Learn more: Logging data events for Amazon SNS with CloudTrail

Community Discussion

No comments yet. Be the first to start the discussion!