ANS-C01 Question 458
Select 2Your company has deployed an application in a VPC on AWS, and you are tasked with ensuring that security policies are being enforced and audited. The application is accessed via an Application Load Balancer (ALB). You need to validate that no unauthorized IP addresses are accessing the application and ensure logs are stored for auditing purposes. Which combination of AWS services and features should you use to achieve this?
- A
Enable AWS WAF on the ALB and configure rules to block traffic from unauthorized IP addresses.
- B
Use VPC Flow Logs to capture all network traffic and store the logs in Amazon S3 for auditing.
- C
Enable Amazon GuardDuty to continuously monitor and generate alerts for unauthorized access attempts.
- D
Configure AWS CloudTrail to log ALB-related API activity for auditing.
- E
Set up AWS Config to continuously monitor configuration changes to the ALB security groups.
Show answer and explanation
Correct answers: A, B
Explanation
To validate and audit security, AWS WAF can be used to enforce rules that block unauthorized IP addresses, and VPC Flow Logs can capture and log network traffic for auditing. While GuardDuty, CloudTrail, and AWS Config provide valuable security and monitoring capabilities, they do not directly address the requirements of this specific scenario.
- A. Correct.
Enabling AWS WAF on the ALB and configuring rules to block traffic from unauthorized IP addresses directly addresses the requirement to block unauthorized access.
- B. Correct.
VPC Flow Logs provide detailed network traffic information at the VPC level, which can be used to validate and audit network activity, including unauthorized IP addresses.
- C. Incorrect.
Amazon GuardDuty is a threat detection service, but it is designed to detect suspicious activity rather than specifically validating or auditing network traffic logs.
- D. Incorrect.
AWS CloudTrail logs API activity, which is helpful for auditing API calls, but it does not provide insights into network traffic or unauthorized IP addresses.
- E. Incorrect.
AWS Config monitors configuration changes but does not validate or audit network traffic or enforce IP-based restrictions.