SCS-C02 Question 88
Select 3Your organization has recently deployed an application on AWS, which processes sensitive customer data. As the security engineer, you are tasked with designing and implementing monitoring and alerting mechanisms to identify unauthorized access attempts to the application resources. Which combination of actions will best meet this requirement?
- A
Enable AWS CloudTrail for all management and data events, and log them to an S3 bucket for analysis.
- B
Configure Amazon GuardDuty to monitor for unauthorized and suspicious activity across your AWS environment.
- C
Use AWS Config to track compliance of IAM policies and automatically remediate any unauthorized changes to them.
- D
Set up Amazon CloudWatch Alarms to alert on high error rates or unusual patterns in application logs.
- E
Enable AWS WAF logging to monitor and analyze web requests to the application.
Show answer and explanation
Correct answers: A, B, D
Explanation
To design and implement monitoring and alerting for unauthorized access attempts, you need a combination of tools like AWS CloudTrail for logging, Amazon GuardDuty for threat detection, and Amazon CloudWatch Alarms for real-time alerting. These services collectively cover monitoring, detection, and alerting, which are essential for addressing security events. AWS Config and AWS WAF logging, although valuable, do not directly address the requirement in this context.
- A. Correct.
Correct. Enabling AWS CloudTrail provides comprehensive logging for both management and data events, which is critical for identifying unauthorized access attempts.
- B. Correct.
Correct. Amazon GuardDuty is a managed threat detection service that provides continuous monitoring for malicious activity and unauthorized behavior.
- C. Incorrect.
Incorrect. While AWS Config can track compliance and enforce policy changes, it is not directly used for monitoring unauthorized access attempts.
- D. Correct.
Correct. Amazon CloudWatch Alarms can detect unusual patterns or errors that might indicate unauthorized access attempts or other security-related anomalies.
- E. Incorrect.
Incorrect. AWS WAF logging is useful for analyzing web traffic patterns, but it is more focused on web application-level protections rather than general unauthorized access monitoring.