SCS-C02 Question 170
Select 2Your organization has enabled VPC Flow Logs for troubleshooting and analyzing network traffic patterns in a sensitive environment. The logs are stored in an S3 bucket. As a security engineer, you need to analyze these logs to identify unusual network behavior, such as a spike in rejected traffic. Which of the following AWS services or tools can you utilize to perform this analysis effectively?
- A
Amazon Athena
- B
AWS CloudTrail
- C
Amazon CloudWatch Logs Insights
- D
Amazon Macie
- E
Amazon QuickSight
Show answer and explanation
Correct answers: A, C
Explanation
To analyze VPC Flow Logs stored in an S3 bucket, Amazon Athena and Amazon CloudWatch Logs Insights are the most appropriate tools. Athena allows you to run SQL-based queries directly on the data in S3, while CloudWatch Logs Insights provides an efficient way to query and analyze log data in CloudWatch. CloudTrail, Macie, and QuickSight are not designed for this specific use case.
- A. Correct.
Amazon Athena is a serverless query service that allows you to analyze data directly in S3 using SQL queries. It can be used to query VPC Flow Logs stored in S3 for anomalies or specific patterns.
- B. Incorrect.
AWS CloudTrail is used to log and monitor API activity within AWS, but it is not designed for analyzing VPC Flow Logs. Therefore, it is not suitable for this task.
- C. Correct.
Amazon CloudWatch Logs Insights is a powerful tool for querying and analyzing log data, including VPC Flow Logs. It supports custom queries to detect patterns such as spikes in rejected traffic.
- D. Incorrect.
Amazon Macie is a security service focused on discovering sensitive data and protecting it. It does not provide tools for analyzing VPC Flow Logs or network patterns.
- E. Incorrect.
Amazon QuickSight is a business intelligence tool designed for data visualization. While it can visualize data, it is not specifically designed for querying and analyzing log data like VPC Flow Logs.