ANS-C01 Question 457
Select 3Your organization has deployed a critical web application in an Amazon VPC, and you need to ensure that unauthorized access attempts are identified and logged in real-time. To achieve this, you have decided to use AWS native network monitoring and logging services. Which combination of services and configurations should you use to validate and audit security effectively?
- A
Enable VPC Flow Logs for the VPC and send logs to Amazon S3 for auditing.
- B
Use AWS CloudTrail to monitor API activity related to network configuration changes.
- C
Set up AWS WAF to block unauthorized access and log requests using Amazon Kinesis Data Firehose.
- D
Configure Amazon GuardDuty to detect suspicious network activity.
- E
Enable NAT Gateway logging to capture all outbound internet traffic.
Show answer and explanation
Correct answers: A, B, D
Explanation
To validate and audit security using network monitoring and logging services, a combination of VPC Flow Logs, AWS CloudTrail, and Amazon GuardDuty provides comprehensive coverage. VPC Flow Logs capture detailed traffic data, CloudTrail tracks API activity and changes to network configurations, and GuardDuty detects anomalous activity. These services work together to monitor, log, and audit network security effectively.
- A. Correct.
VPC Flow Logs capture detailed information about traffic to and from network interfaces in your VPC. Sending Flow Logs to Amazon S3 helps with storage and auditing for security purposes.
- B. Correct.
AWS CloudTrail provides visibility into API calls and changes to network configurations, which is critical for validating and auditing network security.
- C. Incorrect.
While AWS WAF is useful for blocking unauthorized access to web applications, it is not primarily a network monitoring or logging service. It focuses on application-layer protection rather than VPC-level monitoring.
- D. Correct.
Amazon GuardDuty uses machine learning to detect unusual or suspicious network activity, making it a key service for auditing and validating security.
- E. Incorrect.
NAT Gateway logging is not currently available as a feature in AWS for capturing outbound internet traffic. This makes it an invalid option for this scenario.