SCS-C02 Question 129
Select 3An organization is using AWS to host its applications and wants to ensure that logs are properly collected and analyzed to monitor security events. They are specifically interested in tracking API activity, monitoring network traffic within their VPC, and gaining insight into DNS queries. Which combination of AWS services and features should they use to achieve this?
- A
AWS CloudTrail for API activity logging
- B
VPC Flow Logs for monitoring network traffic within the VPC
- C
Amazon Route 53 Resolver Query Logging for DNS query insights
- D
AWS Trusted Advisor for generating security event logs
- E
Amazon Macie for tracking API activity
Show answer and explanation
Correct answers: A, B, C
Explanation
The organization needs to use a combination of AWS services to monitor different types of logs for security purposes. AWS CloudTrail is necessary for tracking API calls and user activities, VPC Flow Logs provide visibility into network traffic within the VPC, and Amazon Route 53 Resolver Query Logging offers insights into DNS queries. Together, these services provide comprehensive logging capabilities for monitoring security events in the AWS environment.
- A. Correct.
AWS CloudTrail is the correct service for logging API activity. It records API calls made in your AWS account, providing visibility into user and service actions.
- B. Correct.
VPC Flow Logs capture information about the IP traffic going to and from network interfaces in your VPC, which helps in monitoring network traffic.
- C. Correct.
Amazon Route 53 Resolver Query Logging is used to capture DNS query logs, which provides insights into DNS queries made in your VPC.
- D. Incorrect.
AWS Trusted Advisor is a service that provides recommendations for optimizing resources, but it does not generate security event logs or monitor activities directly.
- E. Incorrect.
Amazon Macie is a security service for identifying sensitive data and monitoring for anomalies, but it is not used for tracking API activity.