SCS-C02 Question 161
Single answerAn organization needs to analyze security logs from multiple AWS accounts in near real-time. The solution must centralize logs from services such as Amazon VPC Flow Logs, AWS CloudTrail, and AWS WAF logs into a single location for analysis. The organization also requires the ability to run queries and visualize trends. Which solution design meets these requirements?
- A
Use AWS CloudTrail to enable log file delivery to an S3 bucket and analyze logs using Amazon Athena.
- B
Use Amazon Kinesis Data Firehose to collect logs from all accounts, deliver them to Amazon S3, and analyze them with Amazon OpenSearch Service.
- C
Enable AWS Config to automatically aggregate logs from all accounts into a single regional S3 bucket and use AWS Glue for log analysis.
- D
Use Amazon CloudWatch Logs Insights to directly query logs from all accounts and visualize trends without centralizing the logs.
Show answer and explanation
Correct answer: B
Explanation
The organization requires a solution that can centralize logs in near real-time and support querying and visualization. Amazon Kinesis Data Firehose is designed for real-time log ingestion and delivery to Amazon S3. Amazon OpenSearch Service can index the logs stored in S3 and provide querying and visualization capabilities, making this option the most suitable choice.
- A. Incorrect.
While this option allows you to analyze CloudTrail logs using Amazon Athena, it does not support real-time log ingestion or logs from services like VPC Flow Logs and AWS WAF. It also lacks the ability to visualize trends directly.
- B. Correct.
This is the correct answer. Amazon Kinesis Data Firehose can ingest logs from multiple AWS accounts in near real-time and deliver them to Amazon S3. From S3, the logs can be indexed and analyzed using Amazon OpenSearch Service, which supports querying and visualization of trends.
- C. Incorrect.
AWS Config is used for resource configuration management and compliance tracking, not for log aggregation or analysis. This solution does not meet the requirements for near real-time ingestion or visualization.
- D. Incorrect.
Amazon CloudWatch Logs Insights is a powerful querying tool for logs, but it does not centralize logs from multiple accounts into a single location. Each account would need its own queries and would lack a unified view.