DOP-C02 Question 401
Select 2Your organization has adopted AWS for hosting its applications and wants to ensure that compliance and security best practices are followed. You have been tasked with designing an automated auditing solution to monitor configuration changes across resources, detect unauthorized network traffic, and identify any drift in infrastructure-as-code (IaC) deployments. Which combination of AWS services should you use to achieve this goal?
- A
AWS Config to track configuration changes and compliance, VPC Flow Logs to monitor network traffic, and CloudFormation Drift Detection to identify infrastructure drift.
- B
Amazon CloudWatch to monitor configuration compliance, AWS Config for infrastructure drift detection, and AWS CloudTrail to monitor network traffic.
- C
AWS CloudTrail for API activity logging, AWS Config for compliance and configuration changes, and VPC Flow Logs to monitor network traffic.
- D
AWS Config for configuration tracking, AWS X-Ray for tracking unauthorized API activity, and CloudFormation Drift Detection for infrastructure drift.
Show answer and explanation
Correct answers: A, C
Explanation
To design an automated auditing solution, you need to combine services that monitor different aspects of your AWS environment. AWS Config is used to track configuration changes and ensure compliance. VPC Flow Logs monitor network traffic for unauthorized access. AWS CloudTrail is essential for logging API activity, while CloudFormation Drift Detection identifies discrepancies between IaC templates and actual resource deployments. Together, these services provide comprehensive auditing and security monitoring.
- A. Correct.
This is correct. AWS Config tracks configuration changes, VPC Flow Logs monitor network traffic, and CloudFormation Drift Detection identifies drift between deployed resources and the CloudFormation template.
- B. Incorrect.
This is incorrect. Amazon CloudWatch is not designed for monitoring configuration compliance. AWS Config and CloudFormation Drift Detection are better suited for tracking resource compliance and infrastructure drift.
- C. Correct.
This is correct. AWS CloudTrail records API activity and changes, AWS Config audits configuration changes, and VPC Flow Logs monitor network traffic, providing a robust auditing solution.
- D. Incorrect.
This is incorrect. AWS X-Ray is used for tracing distributed applications but is not suitable for auditing API activity. AWS CloudTrail is the appropriate service for logging API activity.