AWS DevOps Engineer Professional Practice Test

How can you monitor for potential exposure of AWS credentials?

1. Regularly change access keys

2. Enable CloudTrail logging

3. Utilize the AWS_RISK_CREDENTIALS_EXPOSED Health event

4. Set up AWS CloudWatch Alarms

The correct answer is: Utilize the AWS_RISK_CREDENTIALS_EXPOSED Health event

The selection of utilizing the AWS_RISK_CREDENTIALS_EXPOSED Health event is the correct approach to monitor for potential exposure of AWS credentials. This health event provides timely information specifically aimed at identifying and alerting users to situations where AWS credentials may have been exposed, enabling organizations to take immediate action to mitigate any risks related to unauthorized access. While changing access keys regularly can be a part of good security hygiene, it does not actively monitor for potential exposures. Regularly changing access keys can help minimize the impact of exposed credentials if preventative measures fail, but it does not provide real-time insights or alerts regarding current exposure risks. Enabling CloudTrail logging enhances visibility into actions performed within your AWS environment, allowing you to audit access and usage of resources. However, it does not proactively alert you to credential exposures; instead, it relies on you to sift through logs to identify suspicious activity after an incident may have occurred. Setting up AWS CloudWatch Alarms would be helpful for monitoring resource metrics and services; however, it generally does not extend to monitoring specific user credential exposures unless explicit metrics have been defined. Thus, it may not provide direct insights into credential risks. In summary, the use of the AWS_RISK_CREDENTIALS_EXPOSED Health event is