Examkin

Question

Difficulty: MediumSecurity Logging, Monitoring, and Auditing

A retail company's security team wants to monitor log files generated by an application running on Amazon EC2 instances. They need to aggregate these logs in a central location, monitor them for specific patterns (such as failed authentication attempts), and send real-time alerts to the team when a threshold is exceeded. Which AWS service should the company use to meet these requirements?

  1. A
    AWS CloudTrail
  2. B
    Amazon Inspector
  3. Amazon CloudWatchAnswer
  4. D
    AWS Support (since monitoring and auditing application-level log files is the responsibility of AWS under the Shared Responsibility Model)

Answer

Amazon CloudWatch is the service that should be used because it collects and aggregates application logs, monitors them for patterns, and triggers alarms.
Amazon CloudWatch is designed to collect logs, metrics, and events from AWS resources and applications. By installing the CloudWatch agent on Amazon EC2 instances, the security team can push custom application logs to CloudWatch Logs, use metric filters to look for specific patterns like failed login attempts, and set up CloudWatch Alarms to send real-time notifications.

Step-by-Step Solution

1
Analyze the request requirements: the company needs to aggregate log files generated inside an Amazon EC2 instance (guest OS/application level) and set up metric filters/alarms based on pattern matching (like failed logins).
Identified log aggregation and custom pattern alerting as the primary requirements.
This establishes the scope of the required service capabilities.
2
Evaluate the capabilities of Amazon CloudWatch Logs for EC2 instances.
Amazon CloudWatch Logs can collect custom application and system logs using the CloudWatch agent installed on the instance.
This confirms CloudWatch can fulfill the aggregation requirement.
3
Determine how to monitor for specific patterns and send real-time alerts.
CloudWatch Logs allows the creation of metric filters (to count specific terms or patterns) and CloudWatch Alarms (to send alerts, such as via Amazon SNS, when thresholds are exceeded).
This confirms CloudWatch fulfills the real-time alerting requirement.

Key Concept

Amazon CloudWatch logs performance metrics, application logs, and resource metrics, allowing users to configure alarms for real-time monitoring and alerting.
Estimated Time:1m 30s
Rate this question

Topics

Security Logging, Monitoring, and Auditing

More questions from this topic