ANS-C01 Question 123
Select 3An organization is using an Application Load Balancer (ALB) to distribute traffic to its application servers. They want to analyze user access patterns and troubleshoot potential issues by logging all incoming requests. What steps should the organization take to enable access logging for the ALB?
- A
Enable access logging on the ALB and specify an S3 bucket to store the logs.
- B
Ensure the specified S3 bucket has a bucket policy that allows the ALB to write logs to it.
- C
Enable CloudTrail logging for the ALB to capture all incoming requests.
- D
Configure CloudWatch Logs to receive access logs directly from the ALB.
- E
Verify that the S3 bucket is in the same region as the ALB.
Show answer and explanation
Correct answers: A, B, E
Explanation
To enable access logging for an Application Load Balancer (ALB), you must configure it to send logs to an S3 bucket. Additionally, you need to ensure a bucket policy grants the ALB permission to write logs and verify that the bucket is in the same region as the ALB. CloudTrail is not used for ALB access logging, and logs cannot be sent directly to CloudWatch Logs. These steps ensure proper logging for analyzing and troubleshooting user access patterns.
- A. Correct.
Correct: Access logging for an ALB must be explicitly enabled, and you must specify the S3 bucket where the logs will be stored.
- B. Correct.
Correct: The S3 bucket needs a bucket policy granting the ALB permissions to write logs. Without this, the access logs cannot be delivered.
- C. Incorrect.
Incorrect: CloudTrail is used for logging API activity in your AWS account, not for capturing access logs for an ALB.
- D. Incorrect.
Incorrect: ALB access logs are not sent directly to CloudWatch Logs. Logs are stored in S3, and you can use other tools to analyze them.
- E. Correct.
Correct: The S3 bucket used for access logs must be in the same region as the ALB to ensure compatibility and proper log delivery.