SCS-C02 Question 130
Select 3An organization wants to monitor and log all API activity within its AWS account to ensure compliance and perform security audits. The security team also wants to analyze network traffic flowing into and out of specific Amazon VPCs. Which combination of AWS services and features should the organization use?
- A
AWS CloudTrail for logging API activity
- B
VPC Flow Logs for capturing detailed packet-level network data
- C
Amazon CloudWatch Logs for storing and analyzing log data
- D
DNS logs in Amazon Route 53 for monitoring DNS queries
- E
AWS Config for recording configuration changes to AWS resources
Show answer and explanation
Correct answers: A, C, D
Explanation
To comply with security and audit requirements, the organization must log API activity using AWS CloudTrail and analyze the logs using Amazon CloudWatch Logs. Additionally, DNS logs in Amazon Route 53 provide visibility into DNS query activity, which can enhance security monitoring. VPC Flow Logs and AWS Config, while useful for other purposes, do not fully address the described use case.
- A. Correct.
Correct. AWS CloudTrail provides logging of all API activity in the AWS account, which is essential for compliance and security audits.
- B. Incorrect.
Incorrect. VPC Flow Logs capture metadata about IP traffic but do not provide detailed packet-level data. While useful, they are not explicitly required for this use case.
- C. Correct.
Correct. Amazon CloudWatch Logs can be used to store, monitor, and analyze logs, including those from AWS CloudTrail, providing insights for compliance and security.
- D. Correct.
Correct. DNS logs in Amazon Route 53 can be used to monitor DNS queries, which can be helpful for security auditing and detecting suspicious activity.
- E. Incorrect.
Incorrect. AWS Config tracks configuration changes but does not log API activity or network traffic, so it is not relevant to this specific use case.