SCS-C02 Question 153
Select 3Your organization has implemented an application hosted on AWS that processes sensitive customer data. To meet compliance requirements, you need to log and monitor any changes to the AWS resources used by the application. Additionally, you must capture network traffic metadata and DNS query logs for security analysis. Which combination of AWS services should you use to achieve this?
- A
AWS CloudTrail
- B
Amazon VPC Flow Logs
- C
AWS Config
- D
Amazon Route 53 Resolver Query Logs
- E
Amazon GuardDuty
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet the requirements, you need to log changes to AWS resources, capture network traffic metadata, and collect DNS query logs. AWS CloudTrail logs API calls to track resource changes. Amazon VPC Flow Logs provide metadata for network traffic analysis, and Route 53 Resolver Query Logs capture DNS query data. These services together fulfill the compliance and security needs outlined in the scenario.
- A. Correct.
AWS CloudTrail provides logging of API calls made to AWS services, which helps track changes to AWS resources. This is essential for compliance.
- B. Correct.
Amazon VPC Flow Logs capture metadata about network traffic flowing to and from a VPC, which is useful for security analysis.
- C. Incorrect.
AWS Config tracks configuration changes to AWS resources but does not provide network traffic or DNS query logging. It is not required in this scenario.
- D. Correct.
Amazon Route 53 Resolver Query Logs capture DNS query data, which can be used for security analysis. This is relevant to the scenario.
- E. Incorrect.
Amazon GuardDuty is a threat detection service that analyzes data sources like CloudTrail logs and VPC Flow Logs but does not directly provide logging capabilities for your application.