SOA-C02 Question 279
Select 3Your company is experiencing unexpected network traffic spikes, and you have been tasked with identifying the sources of the traffic. The network is configured with a VPC and an Application Load Balancer (ALB). You also have AWS WAF configured to block certain types of malicious requests. Which combination of logs would be most effective to analyze in order to identify the source of the traffic and the type of requests being sent?
- A
VPC Flow Logs
- B
ELB Access Logs
- C
AWS WAF Web ACL Logs
- D
CloudFront Logs
- E
AWS CloudTrail Event Logs
Show answer and explanation
Correct answers: A, B, C
Explanation
To address the issue of unexpected traffic spikes, it is crucial to analyze logs that provide insights into the source and nature of the traffic. VPC Flow Logs help identify the source IP addresses, ELB Access Logs reveal detailed request information processed by the Application Load Balancer, and AWS WAF Web ACL Logs show details about blocked or allowed requests. Together, these logs provide a comprehensive view of the traffic and help pinpoint its source and intent.
- A. Correct.
VPC Flow Logs capture detailed information about the IP traffic going to and from network interfaces in your VPC. They are crucial for identifying the source IPs of unusual traffic spikes.
- B. Correct.
ELB Access Logs provide detailed information about the requests processed by your Application Load Balancer, including client IPs, request paths, and latencies. These logs are essential for understanding the traffic patterns and identifying anomalies.
- C. Correct.
AWS WAF Web ACL Logs contain detailed information about requests inspected by WAF, including allowed and blocked requests. These logs are useful for identifying malicious traffic and verifying that WAF is effectively blocking it.
- D. Incorrect.
CloudFront Logs are relevant only if you are using CloudFront for content delivery. Since the scenario does not mention CloudFront, these logs are not applicable.
- E. Incorrect.
AWS CloudTrail Event Logs capture API activity and changes made within your AWS environment. While useful for tracking configuration changes, they are not effective for analyzing network traffic or request patterns.