SCS-C02 Question 155
Select 3A financial services company wants to monitor and log all user activities across its AWS environment, including API calls, changes to AWS resources, and network traffic within their VPC. The company also needs to store these logs for compliance purposes. Which combination of AWS services and features should they use to achieve this?
- A
Enable AWS CloudTrail to log API activity and resource changes.
- B
Enable VPC Flow Logs to capture network traffic within the VPC.
- C
Use AWS Config to monitor changes to resource configurations.
- D
Enable Amazon S3 to store logs generated by AWS CloudTrail and VPC Flow Logs.
- E
Activate AWS Shield to protect against DDoS attacks.
Show answer and explanation
Correct answers: A, B, D
Explanation
To achieve comprehensive logging of API calls, resource changes, and network traffic, the company should enable AWS CloudTrail, VPC Flow Logs, and store these logs in Amazon S3 for compliance purposes. CloudTrail logs API activities and resource modifications, while VPC Flow Logs monitor network traffic. Amazon S3 provides a cost-effective, durable storage solution for storing logs over time. AWS Config and AWS Shield are not directly relevant for this specific logging requirement.
- A. Correct.
CloudTrail is used to log API activity and changes to AWS resources, which is critical for tracking user activities in the account.
- B. Correct.
VPC Flow Logs are used to capture and monitor network traffic within a VPC, which helps monitor network communication and detect anomalies.
- C. Incorrect.
While AWS Config tracks resource configurations and changes, it is not a logging service for API calls or network traffic.
- D. Correct.
Amazon S3 can be used as a durable storage solution to store logs generated by services like CloudTrail and VPC Flow Logs, which is necessary for long-term compliance and auditing.
- E. Incorrect.
AWS Shield is a security service focused on DDoS protection, but it does not provide logging capabilities.