ANS-C01 Question 124
Select 2You are designing a solution for a global e-commerce platform that uses an Application Load Balancer (ALB) in front of multiple EC2 instances deployed across multiple Availability Zones. The security team has requested detailed access logs for all incoming and outgoing traffic to the ALB for compliance purposes. What steps should you take to ensure that access logging is properly configured for the ALB?
- A
Enable access logging on the ALB and specify an S3 bucket as the target for the logs.
- B
Ensure the S3 bucket used for access logs has a bucket policy that grants write permissions to the ALB.
- C
Enable VPC Flow Logs on the VPC where the ALB is deployed to capture detailed access logs.
- D
Configure an IAM role for the ALB to write logs to the specified S3 bucket.
- E
Enable CloudTrail to log all API activity for the ALB.
Show answer and explanation
Correct answers: A, B
Explanation
To properly configure access logging for an Application Load Balancer, you need to enable access logging on the ALB and specify an S3 bucket where the logs will be stored. Additionally, the S3 bucket must have a bucket policy that grants write permissions to the ALB. This ensures that all incoming and outgoing traffic is logged for compliance and troubleshooting purposes. VPC Flow Logs, IAM roles, and CloudTrail are not relevant to ALB access logging.
- A. Correct.
This is correct because enabling access logging on the ALB and specifying an S3 bucket is required to capture and store access logs for the ALB.
- B. Correct.
This is correct because the S3 bucket must have a bucket policy that allows the ALB to write access logs to it.
- C. Incorrect.
This is incorrect because VPC Flow Logs capture network-level traffic metadata, not application-level access logs specific to the ALB.
- D. Incorrect.
This is incorrect because the ALB does not require an IAM role to write logs to the S3 bucket. Instead, the S3 bucket policy handles the permissions.
- E. Incorrect.
This is incorrect because while CloudTrail logs API-level activity, it does not capture detailed access logs for the ALB.