SCS-C02 Question 136
Select 3Your organization has recently deployed an application on Amazon EC2 instances. The security team wants to ensure that sufficient logging is in place to detect unauthorized access attempts and debug application errors effectively. Which of the following logging configurations should you implement to meet these requirements?
- A
Enable VPC Flow Logs to capture traffic going to and from the EC2 instances.
- B
Configure the application to log errors and debug messages with appropriate verbosity levels.
- C
Enable AWS CloudTrail to record API activity related to the EC2 instances.
- D
Set up AWS Config to track configuration changes for the EC2 instances.
- E
Increase the logging level to 'TRACE' for all AWS services in use.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet the requirements of detecting unauthorized access attempts and debugging application errors effectively, you need a combination of VPC Flow Logs for network-level monitoring, application-level logging with appropriate verbosity, and AWS CloudTrail for API activity visibility. AWS Config is not directly related to logging, and setting all services to 'TRACE' level is not practical or efficient.
- A. Correct.
VPC Flow Logs capture network traffic metadata, which can help detect unauthorized access attempts or suspicious traffic patterns. This is relevant for security monitoring.
- B. Correct.
Configuring the application to log errors and debug messages with appropriate verbosity levels ensures that you capture necessary information for debugging and resolving application issues.
- C. Correct.
AWS CloudTrail provides detailed visibility into API activity, including actions taken on EC2 instances. This is critical for detecting unauthorized access or changes to the environment.
- D. Incorrect.
AWS Config tracks resource configurations and changes over time but does not provide logging related to access attempts or application errors. It is not directly relevant to the scenario's requirements.
- E. Incorrect.
Setting all AWS services to 'TRACE' logging level would generate an excessive volume of logs, making it difficult to identify relevant information. This is not a recommended approach.