At a SaaS company, the cloud console records who called the storage API, and a guest agent shows a process reading files inside a workload. Which record shows who changed a bucket policy?
Select an answer to reveal the explanation.
Short Explanation
The lobby book shows who changed the lock rules, while a camera in one room only shows a person reading. You trace a bucket-policy change to the cloud control-plane audit, not to the guest process list. Office flow records, a laptop quarantine, and a badge report point at other events.
Full Explanation
Changing a bucket policy is an API call against the cloud storage control plane. The console audit records which principal called that API. A process list inside the guest shows a workload reading files, which can be a later data-access question and is not the identity that changed the policy. The record that settles the policy change is: The cloud control-plane audit of who called the storage API, not the guest process list. Office conversations do not name that API caller. Office-LAN NetFlow that summarizes conversations and does not identify the storage API caller can show that a laptop talked to the cloud and still cannot say who issued the policy call. A file quarantine is a local malware action. A laptop antivirus log that records one quarantined file on an engineer workstation names a file on a workstation, not a storage-policy principal. Building entry is physical. A badge-reader report of entries into the office where the engineer laptops are kept shows who walked in and not who called the storage API. Exam caveat: control-plane audit and workload telemetry answer different questions. Who changed the bucket policy is the API audit. Which process later read objects is the guest agent. Operational check: in the cloud audit log, filter for the storage API action that changes bucket policy and read the principal, then keep the guest process list for the separate question of which process read the objects.