SCS-C02 Question 47
Single answerAn e-commerce company uses Amazon CloudWatch to monitor its application logs and identify potential security anomalies. After implementing CloudWatch Logs Insights, the security team wants to visualize login attempts to detect unusual activity, such as a spike in failed logins. Which approach should the team use to create visualizations for identifying anomalies effectively?
- A
Create a CloudWatch Logs Insights query to filter login events, use the 'fields' command to extract relevant data, and create a CloudWatch dashboard with a line chart.
- B
Export CloudWatch Logs data to Amazon S3, process it using AWS Glue, and visualize it using Amazon QuickSight.
- C
Enable AWS Trusted Advisor to analyze CloudWatch Logs and generate anomaly reports in a dashboard format.
- D
Use AWS Config to monitor login attempts and automatically create visualizations of anomalies in the CloudWatch console.
Show answer and explanation
Correct answer: A
Explanation
The best way to visualize anomalies in login attempts using CloudWatch Logs is to leverage CloudWatch Logs Insights for querying log data and creating visualizations in a CloudWatch dashboard. This approach is both efficient and purpose-built for monitoring and analyzing log data to detect anomalies.
- A. Correct.
This is the correct approach. CloudWatch Logs Insights allows you to query log data directly and extract relevant fields such as login attempts. The results can be visualized by creating a CloudWatch dashboard with appropriate widgets, such as line charts, to identify patterns or anomalies.
- B. Incorrect.
While this option is possible, it introduces unnecessary complexity. Exporting data to S3 and using AWS Glue and QuickSight is not the most efficient or direct solution for visualizing login anomalies.
- C. Incorrect.
AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not analyze CloudWatch Logs or generate visualizations for anomalies.
- D. Incorrect.
AWS Config is a service for tracking resource configurations and compliance. It does not directly monitor login attempts or create visualizations for anomalies in CloudWatch.