SCS-C02 Question 82
Select 2Your organization has deployed a web application using Amazon EC2 instances behind an Application Load Balancer (ALB). As part of your security compliance requirements, you need to monitor for unauthorized access patterns and ensure that log data is retained for auditing purposes. Which combination of steps should you take to meet these requirements?
- A
Enable access logging on the Application Load Balancer and configure the logs to be sent to an Amazon S3 bucket with proper permissions.
- B
Enable AWS CloudTrail logging for the ALB and configure it to send logs to an Amazon CloudWatch Logs group.
- C
Enable Amazon VPC Flow Logs and configure them to capture traffic within the VPC where the ALB and EC2 instances are hosted.
- D
Set up AWS Config to track changes to the ALB's configuration and ensure compliance with security policies.
- E
Use Amazon GuardDuty to continuously monitor for unauthorized access patterns and anomalous behavior.
Show answer and explanation
Correct answers: A, E
Explanation
To monitor unauthorized access patterns effectively and retain logs for auditing, you need to enable access logging on the ALB, which captures detailed HTTP request data. Additionally, Amazon GuardDuty provides continuous threat detection and monitoring for unauthorized access attempts or anomalous behavior. Combining these services ensures both compliance and robust security monitoring.
- A. Correct.
Correct: Enabling access logging on the ALB ensures that HTTP requests are logged and stored in Amazon S3, allowing you to analyze access patterns and retain logs for auditing.
- B. Incorrect.
Incorrect: AWS CloudTrail provides logging for API activity, not for monitoring HTTP requests made to the ALB. ALB access logging is the correct mechanism for this use case.
- C. Incorrect.
Incorrect: VPC Flow Logs capture network traffic within a VPC but do not provide detailed HTTP request data for the ALB. This option is not suitable for monitoring unauthorized access to the web application.
- D. Incorrect.
Incorrect: AWS Config is a configuration management tool that tracks changes to AWS resources but does not provide logging or monitoring for HTTP requests or unauthorized access patterns.
- E. Correct.
Correct: Amazon GuardDuty is a threat detection service that can identify unauthorized access patterns and anomalous traffic, enhancing your monitoring capabilities.