SCS-C02 Question 31
Select 3Your organization has deployed a web application on AWS using Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores logs in Amazon S3. Recently, you noticed unusual traffic patterns, including a sudden spike in requests from a specific IP range that is attempting unauthorized access. Which AWS services and configurations should you use to detect and investigate this security threat?
- A
Enable AWS WAF and configure rules to monitor and block suspicious IP addresses.
- B
Use Amazon GuardDuty to analyze VPC Flow Logs and identify malicious activity.
- C
Enable Amazon Inspector to scan the EC2 instances for software vulnerabilities.
- D
Set up Amazon CloudWatch Alarms to monitor request metrics from the ALB.
- E
Configure Amazon Macie to analyze S3 logs for sensitive data exposure.
Show answer and explanation
Correct answers: A, B, D
Explanation
To detect security threats and anomalies effectively, you need to leverage a combination of services tailored to the specific threat. AWS WAF allows you to monitor and block malicious traffic patterns. Amazon GuardDuty provides threat detection capabilities using logs like VPC Flow Logs, making it highly effective for identifying unusual IP activity. Amazon CloudWatch Alarms enable proactive monitoring of ALB metrics to identify traffic spikes or trends that could indicate unauthorized access attempts. While Amazon Inspector and Amazon Macie are valuable security tools, they do not address the specific use case of detecting traffic anomalies.
- A. Correct.
Correct. AWS WAF can detect and block unusual or malicious traffic patterns, including specific IP addresses, and is a key service for monitoring threats at the application layer.
- B. Correct.
Correct. Amazon GuardDuty detects potential security threats by analyzing VPC Flow Logs, DNS logs, and CloudTrail events, making it suitable for identifying malicious IP activity.
- C. Incorrect.
Incorrect. Amazon Inspector is used for identifying software vulnerabilities and misconfigurations on EC2 instances but does not directly help in detecting traffic anomalies.
- D. Correct.
Correct. Amazon CloudWatch Alarms can monitor ALB metrics (e.g., number of requests, IPs generating high traffic) to detect unexpected spikes in traffic and support further investigation.
- E. Incorrect.
Incorrect. Amazon Macie is used for discovering and protecting sensitive data in S3 but does not provide tools for detecting traffic anomalies or unauthorized access patterns.