SCS-C02 Question 172
Single answerYour organization is investigating a potential security incident, and you need to analyze VPC Flow Logs to identify suspicious traffic patterns. The logs are stored in an S3 bucket, and you want to use a service that allows you to analyze these logs using SQL queries without moving the data to another location. Which AWS service is the most suitable for this use case?
- A
Amazon Athena
- B
Amazon CloudWatch Logs Insights
- C
AWS Glue
- D
AWS Lambda
Show answer and explanation
Correct answer: A
Explanation
Amazon Athena is the best choice for analyzing VPC Flow Logs stored in an S3 bucket. It is a serverless interactive query service that enables you to use SQL to query data directly in S3, without the need to transfer or preprocess the data. This makes it an ideal tool for rapid and scalable analysis in scenarios like this one.
- A. Correct.
Amazon Athena is the correct answer because it allows you to query data stored in S3 using SQL, making it well-suited for analyzing VPC Flow Logs directly from the S3 bucket.
- B. Incorrect.
Amazon CloudWatch Logs Insights is a powerful log analysis service, but it is used for analyzing logs stored in CloudWatch Logs, not in S3. It is not suitable for this scenario.
- C. Incorrect.
AWS Glue is primarily a data integration service designed to prepare and transform data for analytics, but it does not provide the capability to directly query logs in S3 using SQL.
- D. Incorrect.
AWS Lambda is a serverless compute service, not a tool for querying logs or analyzing data stored in S3. It is not relevant to this use case.