SCS-C02 Question 275
Select 4Your company has been experiencing unauthorized access attempts to specific resources in your AWS environment. As a security engineer, you need to identify the source of these attempts. Which log sources should you analyze to gather detailed information about the IP addresses and request patterns used during these unauthorized attempts?
- A
VPC Flow Logs
- B
AWS WAF Logs
- C
Route 53 Query Logs
- D
Amazon CloudTrail Logs
- E
Amazon RDS Performance Insights
Show answer and explanation
Correct answers: A, B, C, D
Explanation
To investigate unauthorized access attempts, you need to analyze log sources that provide visibility into network traffic (VPC Flow Logs), application-layer requests (AWS WAF Logs), DNS queries (Route 53 Query Logs), and API activity (CloudTrail Logs). These log sources collectively allow you to trace and analyze the behavior of unauthorized actors. RDS Performance Insights is not relevant in this context as it focuses on database performance rather than access attempts.
- A. Correct.
VPC Flow Logs capture detailed information about inbound and outbound traffic at the network interface level, including source and destination IP addresses. These logs are critical for identifying traffic patterns and potential sources of unauthorized access.
- B. Correct.
AWS WAF Logs provide detailed information about requests that are allowed or blocked by your Web Application Firewall, including IP addresses and request patterns. They are useful for analyzing unauthorized attempts at the application layer.
- C. Correct.
Route 53 Query Logs contain information about DNS queries made to your hosted zones. These logs can help you identify suspicious DNS activity or unauthorized attempts to access resources via DNS.
- D. Correct.
Amazon CloudTrail Logs record API activity and events across your AWS account, such as unauthorized attempts to access resources. These logs are crucial for identifying the actions taken by unauthorized entities.
- E. Incorrect.
Amazon RDS Performance Insights focuses on database performance metrics and does not provide information relevant to network or application-layer unauthorized access attempts.