SCS-C02 Question 169
Single answerA security team wants to analyze captured VPC Flow Logs to identify unusual network activity and potential security threats. They need a cost-effective solution for querying and analyzing the logs without setting up and managing their own infrastructure. Which solution would best meet their requirements?
- A
Use Amazon Athena to query the logs stored in S3.
- B
Use Amazon CloudWatch Logs Insights to directly analyze the logs.
- C
Export the logs to an on-premises SIEM solution for analysis.
- D
Use Amazon Macie to scan and detect sensitive data in the logs.
Show answer and explanation
Correct answer: A
Explanation
The best solution for analyzing captured VPC Flow Logs stored in S3 is to use Amazon Athena. It is a serverless, pay-per-query service that allows you to analyze large datasets directly in S3 using SQL, making it both cost-effective and infrastructure-free. While other options may provide capabilities, they either require additional infrastructure, incur higher costs, or do not align with the use case of analyzing flow logs.
- A. Correct.
Amazon Athena is a serverless query service that allows you to analyze data stored in S3 using standard SQL. This is a cost-effective and scalable solution to query VPC Flow Logs without the need to manage infrastructure.
- B. Incorrect.
Amazon CloudWatch Logs Insights is a powerful tool for querying and analyzing logs stored in CloudWatch Logs, but it would require the logs to be ingested into CloudWatch, potentially increasing costs. Additionally, VPC Flow Logs are typically stored in S3.
- C. Incorrect.
Exporting the logs to an on-premises SIEM solution might provide analysis capabilities, but it involves additional infrastructure management, higher costs, and lacks the scalability of native AWS services.
- D. Incorrect.
Amazon Macie is used for discovering and protecting sensitive data in S3, not for querying or analyzing network logs like VPC Flow Logs.