SCS-C02 Question 121
Single answerYour company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). As part of a security compliance requirement, you need to retain logs of all requests made to the ALB and analyze them for suspicious activity. Additionally, the logs must be retained for a minimum of 1 year and should be easily queryable for analysis. How should you design the logging solution?
- A
Enable ALB access logging and configure the logs to be stored in an S3 bucket with a lifecycle policy to transition logs to S3 Glacier after 30 days.
- B
Enable VPC Flow Logs and store the logs in Amazon CloudWatch Logs with a retention policy of 1 year.
- C
Enable ALB access logging and store the logs in an S3 bucket. Use Amazon Athena to query the logs as needed.
- D
Enable AWS CloudTrail with data event logging for the ALB to capture all HTTP requests and store the logs in an S3 bucket with a lifecycle policy for 1 year.
Show answer and explanation
Correct answer: C
Explanation
To meet the requirements of logging all ALB requests, retaining logs for at least 1 year, and enabling easy querying for analysis, ALB access logging should be enabled and configured to store logs in an S3 bucket. Amazon Athena is a serverless query service that allows direct analysis of the logs stored in S3, providing an efficient solution for querying without additional infrastructure. Other options either fail to meet the requirements or are not cost-efficient or technically appropriate for the specified use case.
- A. Incorrect.
This option addresses logging for the ALB but does not mention how logs will be analyzed. Additionally, S3 Glacier is optimized for archival storage and is not suitable for querying logs easily.
- B. Incorrect.
VPC Flow Logs capture network-level data and do not provide detailed information about HTTP requests to the ALB. This does not meet the requirement to log all requests made to the ALB.
- C. Correct.
This is the correct solution. ALB access logging provides detailed request logs, and storing them in an S3 bucket allows cost-efficient storage. Amazon Athena enables querying the logs directly from S3 without additional infrastructure, meeting both retention and analysis requirements.
- D. Incorrect.
CloudTrail data event logging is not designed for capturing detailed HTTP request logs for an ALB. Using CloudTrail for this purpose would generate unnecessary costs and would not provide the required level of granularity.