SCS-C02 Question 135
Select 2You are tasked with configuring logging for an AWS application that uses multiple services, including Amazon S3, AWS Lambda, and Amazon CloudFront. The security team has requested that logs be set up to ensure adequate visibility for troubleshooting and security auditing. Which of the following actions should you take to meet these requirements? (Choose TWO)
- A
Enable server access logging on the S3 bucket and configure it to write logs to a separate S3 bucket.
- B
Set the verbosity level of AWS Lambda logs to 'ERROR' to capture only error messages.
- C
Enable CloudFront standard logs and configure a log bucket for storing the access logs.
- D
Disable CloudTrail logging to avoid generating excessive log data.
- E
Use Amazon CloudWatch Logs for Lambda functions and set the log level to 'DEBUG' for detailed troubleshooting.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the security team's requirements for visibility into application activity, it is essential to enable logging for key services like S3 and CloudFront. Enabling server access logging for S3 and standard logs for CloudFront ensures detailed records of access and usage, which are critical for troubleshooting and security auditing. While CloudWatch Logs and verbosity levels for Lambda can also play a role, the chosen options directly address the requirements in a balanced way without generating excessive or incomplete log data.
- A. Correct.
Enabling server access logging on the S3 bucket provides detailed information about requests made to the bucket, which is useful for security auditing. Writing logs to a separate bucket is a security best practice.
- B. Incorrect.
Setting the verbosity level to 'ERROR' for AWS Lambda logs may limit visibility into warnings or other important events, which could hinder troubleshooting and auditing.
- C. Correct.
Enabling CloudFront standard logs provides valuable details about requests, including IP addresses, user agents, and request URIs. Configuring a log bucket ensures these logs are stored for analysis.
- D. Incorrect.
Disabling CloudTrail logging is not recommended, as it reduces visibility into API activity and can hinder security and compliance efforts.
- E. Incorrect.
Using Amazon CloudWatch Logs for Lambda functions is a good practice, but setting the log level to 'DEBUG' may generate excessive log data and increase costs unnecessarily unless required for a specific scenario.