SOA-C02 Question 278
Select 3Your organization is investigating unusual traffic spikes on a web application hosted on AWS. You are tasked with identifying the source IPs of traffic and analyzing potential suspicious behavior. The application uses an Application Load Balancer (ALB) and CloudFront for content delivery. Which logs should you collect and analyze to achieve this?
- A
CloudFront access logs
- B
VPC Flow Logs
- C
ELB access logs
- D
AWS WAF web ACL logs
- E
Amazon S3 server access logs
Show answer and explanation
Correct answers: A, C, D
Explanation
To investigate unusual traffic spikes on a web application, you need logs that provide detailed information about HTTP requests and source IPs. CloudFront access logs, ELB access logs, and AWS WAF web ACL logs are critical in this case as they capture relevant details about user requests, source IPs, and suspicious patterns. VPC Flow Logs are not as relevant as they provide low-level network traffic data, and S3 access logs are unrelated to the application's traffic patterns.
- A. Correct.
CloudFront access logs provide detailed information about requests passing through CloudFront, including source IPs and request URLs, which are critical for investigating traffic spikes.
- B. Incorrect.
VPC Flow Logs capture traffic flow information at the network level but do not provide detailed insights into HTTP requests or user activity, making them less useful for identifying source IPs and suspicious behavior in this scenario.
- C. Correct.
ELB access logs contain information about HTTP requests passing through the ALB, including source IPs, request paths, and response data, which are essential for troubleshooting traffic-related issues.
- D. Correct.
AWS WAF web ACL logs capture detailed information about requests that match WAF rules, including source IPs and request patterns, making them highly relevant for investigating suspicious behavior.
- E. Incorrect.
Amazon S3 server access logs provide details about requests made to an S3 bucket but are irrelevant for analyzing traffic spikes on a web application hosted behind CloudFront and ALB.