ANS-C01 Question 125
Select 3An organization is running a global application using an Application Load Balancer (ALB) and Amazon CloudFront for content delivery. The networking team needs to analyze user behavior and troubleshoot issues by reviewing access logs. How can the team ensure that access logging is configured correctly for both the ALB and CloudFront?
- A
Enable access logging on the Application Load Balancer and specify an S3 bucket to store the logs.
- B
Enable access logging on Amazon CloudFront by specifying an S3 bucket to store the logs in the CloudFront distribution settings.
- C
Configure VPC Flow Logs to capture the traffic going through both the Application Load Balancer and CloudFront.
- D
Ensure the S3 bucket permissions allow write access for the AWS service accounts of the Application Load Balancer and CloudFront.
- E
Enable AWS CloudTrail to log all requests going through both the Application Load Balancer and CloudFront.
Show answer and explanation
Correct answers: A, B, D
Explanation
To properly configure access logging for both the Application Load Balancer and CloudFront, you need to enable access logging on each service and specify an S3 bucket to store the logs. Additionally, proper permissions must be set on the S3 bucket to allow these services to write logs. VPC Flow Logs and AWS CloudTrail serve different purposes and are not a substitute for access logging.
- A. Correct.
Correct. To enable access logging for an ALB, you must specify an S3 bucket to store the logs. This is the correct way to log traffic information for the ALB.
- B. Correct.
Correct. CloudFront access logs can be enabled by specifying an S3 bucket in the CloudFront distribution settings to store the logs.
- C. Incorrect.
Incorrect. VPC Flow Logs capture network traffic at the VPC level, but they do not provide detailed access logging for an ALB or CloudFront.
- D. Correct.
Correct. The S3 bucket storing the logs must have the correct permissions to allow the ALB and CloudFront services to write logs to it. Without these permissions, logging will fail.
- E. Incorrect.
Incorrect. AWS CloudTrail logs API activity and management events but does not log detailed access requests or provide the same functionality as access logs for ALB or CloudFront.