After a questionable change in the city's cloud management account, security needs to review who performed which actions last week. Which capability should they rely on?
Select an answer to reveal the explanation.
Short Explanation
When something weird happens in the management account, you want a flight recorder—not a shrug and a hallway rumor. Audit trails show who clicked what and when so security can reconstruct last week. Turning logs off or wiping them weekly leaves the city flying blind.
Full Explanation
IAM and management-plane audit trails record who did what and when across console and API activity, enabling security to investigate questionable changes in the city’s cloud management account. Relying on those trails for last week’s actions is how municipalities reconstruct events, support accountability, and meet audit expectations.
Deleting all management logs weekly before any review destroys investigative capability. Relying only on verbal recollections without recorded trails fails under dispute. Disabling API logging so console clicks never appear blinds security investigations.
Exam caveat: enable trails in all regions/subscriptions that matter, protect logs from tampering (separate account/WORM), and retain per policy. Audit trails answer "who/what/when," not automatically "why."
Operational check: verify management events are logged, query last week’s write APIs for the suspect account, confirm operator identity and timestamps, and alert on disablement of logging. Include log review steps in the city’s incident response checklist.
Ship management-plane logs to a tamper-resistant archive account separate from the producing subscription so a compromised city admin cannot easily erase the trail of their own API calls.