SCS-C02 Question 164
Select 4Your organization needs to analyze security logs from multiple AWS accounts in near real-time to detect anomalies and potential security threats. Logs are generated by AWS CloudTrail, VPC Flow Logs, and Amazon S3 data events. The solution must centralize log data, ensure durability, enable near real-time analysis, and support integration with machine learning models for anomaly detection. Which combination of steps should you take to design this log analysis solution?
- A
Use AWS Organizations to enable centralized logging by configuring AWS CloudTrail to deliver logs to a central S3 bucket.
- B
Use Amazon Kinesis Data Firehose to stream logs from CloudTrail, VPC Flow Logs, and S3 Data Events into Amazon S3 and enable real-time delivery.
- C
Set up Amazon Athena to query logs directly from the central S3 bucket for real-time log analysis.
- D
Integrate Amazon Kinesis Data Analytics with the Kinesis Data Firehose stream to analyze logs in near real-time and detect anomalies.
- E
Use Amazon OpenSearch Service (formerly Amazon Elasticsearch Service) to index and search logs for anomaly detection and visualization.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To design a log analysis solution for centralized, near real-time security monitoring, you need to collect logs from multiple accounts using AWS Organizations and CloudTrail, stream them in near real-time using Kinesis Data Firehose, and process them for anomaly detection using Kinesis Data Analytics. Amazon OpenSearch Service can further index and visualize the logs, enabling efficient investigation and monitoring. Athena, while useful for querying logs, does not support near real-time analysis, so it's not suitable for this requirement.
- A. Correct.
This is correct because AWS Organizations and centralized CloudTrail configuration allow you to aggregate logs from multiple AWS accounts into a single S3 bucket, which is the first step in centralizing log data.
- B. Correct.
This is correct because Amazon Kinesis Data Firehose streams logs to Amazon S3 with real-time delivery, ensuring logs are quickly available for analysis.
- C. Incorrect.
This is incorrect because Amazon Athena is better suited for ad-hoc querying of static data stored in S3 but does not provide near real-time analysis capabilities.
- D. Correct.
This is correct because Amazon Kinesis Data Analytics can process data streams from Kinesis Data Firehose in near real-time, enabling anomaly detection using machine learning models.
- E. Correct.
This is correct because Amazon OpenSearch Service provides indexing, searching, and visualization capabilities, which are essential for analyzing and detecting anomalies in log data.