SCS-C02 Question 274
Select 3You are a security engineer investigating a potential data exfiltration attempt in your AWS environment. To identify threats and analyze suspicious activity, you decide to review logs from multiple AWS services. Which log sources would provide the most relevant information for this investigation?
- A
VPC Flow Logs to analyze network traffic patterns and connections
- B
AWS WAF logs to examine blocked or allowed web requests
- C
Amazon Route 53 DNS logs to track DNS queries and responses
- D
AWS CloudTrail logs to review API activity and changes to resources
- E
Amazon S3 server access logs to monitor bucket-level access patterns
Show answer and explanation
Correct answers: A, B, C
Explanation
When investigating data exfiltration, logs that provide insights into network traffic (VPC Flow Logs), DNS queries (Route 53 DNS logs), and web request patterns (AWS WAF logs) are highly relevant. These logs help identify unusual behaviors, such as unexpected data flows, malicious domain queries, or web-based exfiltration attempts. While CloudTrail and S3 access logs are critical for other types of monitoring, they are less directly useful for investigating network-level data exfiltration scenarios.
- A. Correct.
VPC Flow Logs are useful for capturing information about IP traffic to and from network interfaces, helping identify unusual data flows that could indicate data exfiltration.
- B. Correct.
AWS WAF logs provide insights into web requests, including details like source IPs and request patterns, which can help detect potential malicious activity targeting web applications.
- C. Correct.
Amazon Route 53 DNS logs are valuable for reviewing DNS queries and responses, which can help identify suspicious DNS activity, such as queries to malicious domains.
- D. Incorrect.
AWS CloudTrail logs are primarily used for tracking API calls and changes to resources, but they do not directly provide network or DNS-level insights for investigating data exfiltration.
- E. Incorrect.
Amazon S3 server access logs focus on access patterns at the bucket level, which is useful for monitoring S3-specific activity but not directly relevant for network-level or DNS-level activity.