SCS-C02 Question 46
Single answerAn organization uses Amazon CloudWatch to monitor its AWS environment. They suspect unauthorized access attempts are being made on an EC2 instance. To investigate, they want to visualize patterns and identify anomalies in EC2 instance login activity. Which approach should the security team use to achieve this?
- A
Use Amazon CloudWatch Logs Insights to query and visualize login activity logs.
- B
Enable AWS Config to create a compliance report for the EC2 instance.
- C
Set up Amazon GuardDuty and review its findings for suspicious login attempts.
- D
Use Amazon QuickSight to directly analyze and visualize CloudTrail logs.
Show answer and explanation
Correct answer: A
Explanation
To identify anomalies in EC2 instance login activity, the security team needs to query and visualize log data effectively. Amazon CloudWatch Logs Insights is specifically designed for querying and visualizing log data, making it the most suitable tool for this scenario. While other tools like GuardDuty and QuickSight can be useful for broader security detection and analysis, they are not the best fit for directly querying and visualizing login activity logs.
- A. Correct.
Correct. Amazon CloudWatch Logs Insights can be used to query logs, such as system logs or application logs, and visualize login activity patterns. This is particularly useful for identifying anomalies in login behavior.
- B. Incorrect.
Incorrect. AWS Config tracks configuration changes and compliance, but it does not provide tools for log analysis or visualization of login activity.
- C. Incorrect.
Incorrect. Amazon GuardDuty provides threat detection and alerts for potential threats such as unauthorized access, but it does not offer direct visualization or querying capabilities for login activity.
- D. Incorrect.
Incorrect. Amazon QuickSight is a powerful business intelligence tool, but it is not designed to directly parse and analyze raw CloudTrail logs. Additional preprocessing would be required to use QuickSight effectively for this purpose.