DEA-C01 Question 528
Select 3Your organization wants to centralize all AWS service logs, such as CloudTrail logs, VPC Flow logs, and application logs, in a single location for analysis and compliance. The solution should allow for scalable storage, long-term retention, and integration with analytics services like Amazon Athena or Amazon OpenSearch Service. Which combination of services and configurations would best meet these requirements?
- A
Use Amazon S3 as the central log storage location and enable S3 Lifecycle policies for long-term retention.
- B
Enable Amazon CloudWatch Logs Insights to query logs directly for analysis.
- C
Use AWS Glue to crawl the logs stored in Amazon S3 and catalog them for querying with Amazon Athena.
- D
Configure AWS CloudTrail and VPC Flow Logs to deliver logs directly to Amazon S3.
- E
Enable AWS Config to collect all resource changes and store them in Amazon S3 as the centralized log repository.
Show answer and explanation
Correct answers: A, C, D
Explanation
Centralizing logs involves using Amazon S3 as a scalable and durable storage solution. Configuring services like CloudTrail and VPC Flow Logs to deliver logs to S3 ensures all logs are collected in a single location. AWS Glue can be used to crawl and catalog the logs in S3, enabling querying with Amazon Athena for analytics. CloudWatch Logs Insights is useful for querying logs in real-time but does not provide centralized storage. AWS Config focuses on resource compliance and configuration tracking, not log centralization.
- A. Correct.
Correct: Amazon S3 provides scalable and durable storage for centralized logs, and S3 Lifecycle policies ensure cost-effective long-term retention.
- B. Incorrect.
Incorrect: While CloudWatch Logs Insights is useful for querying logs, it does not serve as a centralized storage solution. It is more for real-time log analysis.
- C. Correct.
Correct: AWS Glue can catalog the logs stored in Amazon S3, making them queryable with Amazon Athena. This facilitates analytics on the centralized logs.
- D. Correct.
Correct: Configuring AWS services like CloudTrail and VPC Flow Logs to deliver logs directly to Amazon S3 ensures all logs are centralized in one location.
- E. Incorrect.
Incorrect: AWS Config tracks resource configuration changes and compliance but is not intended to centralize all logs or act as a log repository.