SCS-C02 Question 162
Select 2A company needs to analyze security-related logs from multiple AWS services, such as AWS CloudTrail, Amazon VPC Flow Logs, and Amazon S3 access logs. They want to centralize log storage, enable near real-time analysis, and ensure compliance with security regulations. Which design meets these requirements?
- A
Use Amazon S3 as a centralized log storage location and configure Amazon Athena for querying and analysis.
- B
Use Amazon CloudWatch Logs to store all logs and configure CloudWatch Logs Insights for querying and analysis.
- C
Use AWS Glue to transform raw logs into a structured format and store them in Amazon Redshift for further analysis.
- D
Use AWS Security Hub to automatically collect and analyze logs from all AWS services.
- E
Set up an Amazon S3 bucket for centralized log storage, and use AWS Lambda to send logs to Amazon OpenSearch Service for near real-time analysis.
Show answer and explanation
Correct answers: A, E
Explanation
Centralizing logs in Amazon S3 ensures durability, compliance, and cost-effective storage. Amazon Athena allows querying logs directly from S3, making it suitable for analysis. Alternatively, using AWS Lambda to send logs to Amazon OpenSearch Service allows for near real-time analysis, fulfilling the requirements for both centralization and time-sensitive insights.
- A. Correct.
This is correct. Using Amazon S3 as a centralized log storage location ensures compliance and durability, while Amazon Athena provides a cost-effective way to query and analyze logs.
- B. Incorrect.
This is incorrect. While CloudWatch Logs is useful for log storage and CloudWatch Logs Insights supports querying, it is not ideal for centralizing logs from multiple services and doesn't meet the near real-time analysis requirement.
- C. Incorrect.
This is incorrect. AWS Glue and Amazon Redshift can be used for data transformation and analysis, but this approach is more suitable for batch processing rather than near real-time analysis.
- D. Incorrect.
This is incorrect. AWS Security Hub is a security service for aggregation and alerts, but it does not provide the functionality to centralize and analyze raw logs from multiple services.
- E. Correct.
This is correct. Centralizing logs in Amazon S3 ensures compliance and durability, while using AWS Lambda to process and send logs to Amazon OpenSearch Service enables near real-time analysis capabilities.