Question

A security engineer at a company using a public cloud IaaS provider must investigate who deleted a virtual machine and from which source IP the API call originated. The team already collects VPC/network flow logs but cannot determine the identity or management action responsible for the deletion. Which cloud logging capability should the engineer enable to capture this information?

Accepted Answer

Management/API audit logging (such as AWS CloudTrail or Azure Activity Log) that records control-plane API calls, identities, and source IPs

Answer

Additional VPC flow logs on every subnet to capture the deletion traffic

Answer

DNS query logging to correlate the hostname of the deleted VM

Answer

Web application firewall (WAF) logs on the cloud load balancer