ANS-C01 Question 474
Select 3Your organization uses an application hosted in AWS, which includes an Application Load Balancer (ALB), CloudFront as a content delivery network, and multiple EC2 instances within a VPC. The security team requires detailed logs from these services to investigate potential security incidents. Which AWS services and features should you enable to capture the necessary logs?
- A
Enable VPC Flow Logs on the VPC where the EC2 instances are deployed.
- B
Enable access logging on the Application Load Balancer (ALB).
- C
Enable CloudFront standard logging for the distribution.
- D
Enable AWS Config to track changes in the VPC.
- E
Enable GuardDuty for threat detection.
Show answer and explanation
Correct answers: A, B, C
Explanation
To investigate potential security incidents, detailed logs from relevant AWS services are essential. VPC Flow Logs capture network traffic data at the VPC level, ALB access logs provide details about client requests to the load balancer, and CloudFront standard logging captures request data for the distribution. AWS Config and GuardDuty serve other purposes, such as tracking resource configurations or detecting threats, but they do not provide the detailed logging required for this scenario.
- A. Correct.
VPC Flow Logs capture IP traffic data for network interfaces within your VPC, which is essential for analyzing network traffic and identifying potential issues or security incidents.
- B. Correct.
Enabling access logging on the ALB provides details about client requests, which is critical for analyzing traffic patterns and identifying suspicious activity.
- C. Correct.
CloudFront standard logging captures details of requests to the CloudFront distribution, helping with troubleshooting, access patterns, and incident investigations.
- D. Incorrect.
AWS Config tracks changes to resource configurations but does not provide detailed logs of network or application-level access. It is useful for auditing but not for detailed logging of traffic or requests.
- E. Incorrect.
GuardDuty provides threat detection using machine learning and analytics but does not produce detailed logs like VPC Flow Logs or access logs. It is complementary but not a replacement for detailed logging.