SCS-C02 Question 421
Select 3A company is running a web application on EC2 instances behind an Application Load Balancer (ALB). The application processes sensitive customer data, and the security team requires that all access to the application is logged and encrypted. Additionally, they want to ensure that any unauthorized or suspicious activity is detected and flagged automatically. Which combination of actions will meet these requirements?
- A
Enable ALB access logging and store the logs in an S3 bucket with restricted access.
- B
Configure AWS Certificate Manager (ACM) to issue an SSL/TLS certificate and associate it with the ALB.
- C
Attach an AWS WAF web ACL to the ALB with rules to block malicious IP addresses.
- D
Enable VPC Flow Logs to monitor all traffic to and from the web application instances.
- E
Use Amazon Macie to monitor and flag sensitive data processing in the application.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet the company's requirements, ALB access logging must be enabled to capture all access attempts, and traffic must be encrypted using an SSL/TLS certificate issued by ACM. Additionally, AWS WAF can be used to detect and block unauthorized or suspicious activity. VPC Flow Logs and Amazon Macie are useful for other purposes but do not directly address the specific requirements of logging, encryption, and activity detection for the web application.
- A. Correct.
Enabling ALB access logging ensures that all access to the application is logged for auditing and monitoring purposes, and storing the logs in a restricted S3 bucket protects them from unauthorized access. This satisfies the requirement for logging.
- B. Correct.
Using AWS Certificate Manager (ACM) to issue an SSL/TLS certificate and associating it with the ALB ensures that all traffic is encrypted, meeting the requirement for encryption.
- C. Correct.
Attaching an AWS WAF web ACL to the ALB allows you to define rules to block malicious activities, such as traffic from known bad IP addresses, which helps detect and mitigate suspicious activity.
- D. Incorrect.
Enabling VPC Flow Logs monitors network traffic at the VPC level but does not provide detailed application-level access logs or encryption, so it does not fully address the requirements.
- E. Incorrect.
Amazon Macie is used for discovering and protecting sensitive data in S3 buckets. It does not directly monitor or secure traffic to a web application, so it is not relevant in this scenario.