ANS-C01 Question 101
Select 3Your organization operates a hybrid network setup that spans multiple AWS accounts and on-premises data centers. You are tasked with implementing a logging and monitoring solution to ensure comprehensive visibility into network traffic and security events. Your solution must support centralized log analysis, detection of anomalous behavior, and compliance auditing. Which of the following solutions would best meet these requirements?
- A
Enable VPC Flow Logs for all VPCs in AWS and send the logs to a central Amazon S3 bucket.
- B
Configure AWS CloudTrail to log all management events and send logs to Amazon CloudWatch Logs for monitoring.
- C
Deploy an AWS Transit Gateway and enable logging for all inter-VPC and on-premises traffic routed through it.
- D
Use Amazon GuardDuty to monitor network activity for threat detection and send findings to a centralized account.
- E
Install third-party log collection agents on all on-premises servers and forward logs directly to Amazon S3.
Show answer and explanation
Correct answers: A, B, D
Explanation
A robust logging and monitoring solution for a hybrid network setup requires leveraging AWS-native services for both network traffic analysis and security event detection. VPC Flow Logs (Option 1) provide visibility into network traffic, AWS CloudTrail (Option 2) logs management events for compliance and anomaly detection, and Amazon GuardDuty (Option 4) enables threat detection. These solutions together offer centralized monitoring and support compliance and security requirements. Option 3 is not as effective for detailed traffic analysis, and Option 5 focuses only on on-premises logging without addressing AWS network visibility.
- A. Correct.
Enabling VPC Flow Logs allows you to capture network traffic metadata for all VPCs in AWS, which is essential for analyzing and auditing network traffic. Sending the logs to a central Amazon S3 bucket supports centralized log analysis.
- B. Correct.
AWS CloudTrail provides logging for management events, which is crucial for compliance auditing and detecting unauthorized API calls. Sending these logs to Amazon CloudWatch Logs allows for real-time monitoring and anomaly detection.
- C. Incorrect.
While AWS Transit Gateway simplifies routing in hybrid networks, enabling logging on it does not provide detailed visibility into network traffic. VPC Flow Logs are better suited for this requirement.
- D. Correct.
Amazon GuardDuty provides threat detection capabilities by analyzing network activity and AWS account behavior. Sending findings to a centralized account supports unified threat monitoring and response across a hybrid environment.
- E. Incorrect.
While third-party log collection agents can be useful, relying solely on them for on-premises servers does not provide comprehensive visibility into the AWS environment or centralized monitoring using AWS-native tools.