SCS-C02 Question 134
Select 3A company is using Amazon CloudWatch Logs to monitor activity in their AWS environment. The security team wants to ensure that the logging configuration provides detailed information for troubleshooting and compliance, while avoiding unnecessary costs caused by excessive verbosity. Which of the following considerations should the team prioritize when configuring CloudWatch Logs?
- A
Set the appropriate log level, such as ERROR, WARN, or DEBUG, based on the use case.
- B
Enable logging at the highest verbosity level to capture all possible details for future analysis.
- C
Configure log retention policies to automatically delete logs after a specified period to reduce storage costs.
- D
Ensure that logs are encrypted using AWS-managed or customer-managed keys in AWS KMS.
- E
Disable logging for services that are not critical to security to reduce costs.
Show answer and explanation
Correct answers: A, C, D
Explanation
When configuring logging capabilities in AWS, it is important to balance detail and cost. Setting the correct log level ensures that only relevant information is captured, while retention policies help manage costs by deleting old logs. Encrypting logs protects sensitive data, which is crucial for maintaining compliance and security. Enabling excessive verbosity or disabling logging for non-critical services can undermine these goals and is not aligned with AWS security best practices.
- A. Correct.
Setting the appropriate log level is critical to capturing meaningful data without overwhelming the system or incurring unnecessary costs. DEBUG may be useful for troubleshooting, but ERROR or WARN might be sufficient for routine operations.
- B. Incorrect.
While enabling the highest verbosity level captures all details, it can lead to excessive log volumes, increased costs, and difficulty finding relevant information. This is not a best practice unless absolutely necessary.
- C. Correct.
Configuring log retention policies helps manage storage costs by automatically deleting logs that are no longer needed, ensuring compliance and cost efficiency.
- D. Correct.
Encrypting logs using AWS KMS ensures that sensitive information in logs is protected, which is a critical security best practice.
- E. Incorrect.
Disabling logging for non-critical services might save costs, but it can lead to gaps in monitoring and is not recommended for security-sensitive environments.