CloudTrail Event Analysis Quiz

What you'll be asked

1. Which of the following fields in a CloudTrail log entry identifies the IAM user or role that performed the API call?
2. You notice an 'AccessDenied' error in your CloudTrail logs. Which field should you examine to determine which specific IAM policy or SCP denied the request?
3. A security analyst is investigating a suspicious API call. Which field is most useful for determining the geographic origin of the request?
4. If a CloudTrail event has 'readOnly' set to 'true', what does this imply about the API call?
5. You are auditing CloudTrail logs for potential 'AssumeRole' abuse. You see an event where 'userIdentity.type' is 'AssumedRole', but the 'arn' in 'userIdentity.sessionContext.sessionIssuer' does not match the expected source role. What does this indicate?

Answers and explanations come after you submit.