Examkin

Question

Difficulty: HardSecurity Logging, Monitoring, and Auditing

A logistics company is migrating its application to Amazon EC2 instances. The security team needs to implement a logging and monitoring strategy that addresses two requirements: First, they must monitor application-specific log files generated on the EC2 instances for pattern matches and automatically notify administrators if error rates spike. Second, they must continuously analyze AWS API calls and network activity to detect potential security threats, such as compromised credentials or communication with known malicious IP addresses. Which TWO AWS services should the company implement to meet these requirements? (Select TWO.)

  1. Amazon CloudWatch to monitor application log files for error patterns and trigger notifications using alarmsAnswer
  2. Amazon GuardDuty to continuously analyze API events and network logs to identify threat patterns and compromised credentialsAnswer
  3. C
    AWS CloudTrail to monitor application-specific log files and automatically perform threat mitigation on EC2 instances
  4. D
    Amazon Inspector to analyze real-time network logs and generate alerts for active host-level intrusions
  5. E
    AWS Trusted Advisor to automatically apply security patches to the guest operating systems of EC2 instances

Answer

The logistics company should implement Amazon CloudWatch and Amazon GuardDuty.
The correct services are Amazon CloudWatch and Amazon GuardDuty. Amazon CloudWatch collects and monitors log files from resources like EC2 instances using metric filters, allowing administrators to configure alarms and notifications. Amazon GuardDuty uses intelligent threat detection to analyze data sources like CloudTrail logs and VPC Flow Logs to detect malicious activity and compromised credentials.

Step-by-Step Solution

1
Identify the service required to monitor application log files and alert on error thresholds.
Amazon CloudWatch is selected because it collects log files, allows pattern matching via metric filters, and triggers notifications through CloudWatch Alarms.
This satisfies the requirement to monitor EC2 application log files for error rate spikes and notify administrators.
2
Identify the service required to continuously analyze AWS API calls and network activity for active security threats.
Amazon GuardDuty is selected because it is an intelligent threat detection service that analyzes logs (such as CloudTrail and VPC Flow Logs) to identify anomalies and compromised credentials.
This satisfies the requirement to detect security threats like compromised credentials and communication with malicious IPs.

Key Concept

AWS security logging, monitoring, and threat detection services
Rate this question

Topics

Security Logging, Monitoring, and Auditing

More questions from this topic