ANS-C01 Question 459
Select 2Your organization has deployed a multi-tier application in AWS using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. To ensure compliance with the organization's security policies and detect potential unauthorized access attempts, you are tasked with implementing network monitoring and logging. Which actions should you take to validate and audit security in this architecture?
- A
Enable ALB access logs and store them in an S3 bucket for analysis.
- B
Deploy AWS Network Firewall to inspect and log traffic to and from the Auto Scaling group.
- C
Enable VPC Flow Logs for the associated VPC to monitor traffic at the network interface level.
- D
Use AWS CloudTrail to monitor DNS queries made within the VPC.
- E
Configure AWS Config to track configuration changes for the ALB and EC2 instances.
Show answer and explanation
Correct answers: A, C
Explanation
To validate and audit security in this architecture, you need to monitor network activity and log relevant information. Enabling ALB access logs provides detailed insights into request-level activity for the load balancer, while VPC Flow Logs allow you to capture metadata about network traffic in the VPC. These two actions align directly with the goal of auditing and monitoring network security. The other options either address unrelated needs (e.g., configuration compliance) or are not directly applicable to the scenario.
- A. Correct.
Enabling ALB access logs provides detailed information about requests processed by the ALB, including source and destination IPs, user agents, and response codes. This is essential for auditing and monitoring network activity.
- B. Incorrect.
While AWS Network Firewall is useful for inspecting and filtering traffic, it is not specifically required in this scenario, as the focus is on monitoring and logging. Deploying it would add unnecessary complexity unless specific firewall rules were needed.
- C. Correct.
Enabling VPC Flow Logs allows you to capture metadata about network traffic at the VPC, subnet, or ENI level. This is critical for monitoring and auditing network traffic.
- D. Incorrect.
AWS CloudTrail is used to log API calls and user activity within an AWS account, but it does not monitor DNS queries. To track DNS queries, you would need to use Route 53 Resolver Query Logs.
- E. Incorrect.
AWS Config is a service for monitoring and recording resource configurations. While valuable for configuration compliance, it is not directly related to network monitoring and logging in this specific scenario.