Examkin

Question

Difficulty: HardSecurity Logging, Monitoring, and Auditing

A media streaming company wants to implement network-level monitoring and real-time security alerts for its virtual private cloud (VPC) environment. The company has two requirements:

1. Capture detailed information about the IP traffic going to and from network interfaces in the VPC to audit security group rule effectiveness.
2. Create automated alarms that notify the security operations team if there is a sudden spike in unauthorized connection attempts (such as HTTP 403 errors or failed SSH attempts).

Which combination of AWS features or services should the company configure to meet these requirements? (Select TWO.)

  1. VPC Flow LogsAnswer
  2. Amazon CloudWatchAnswer
  3. C
    AWS CloudTrail
  4. D
    Amazon Inspector
  5. E
    AWS Shield

Answer

VPC Flow Logs and Amazon CloudWatch
VPC Flow Logs is designed to capture IP traffic information going to and from network interfaces in a VPC, which allows the company to audit security group rules. Amazon CloudWatch is used to collect metrics, monitor logs, and trigger automated alarms when specific thresholds (such as unauthorized connection spikes) are exceeded.

Step-by-Step Solution

1
Analyze the first requirement: capturing IP traffic going to and from network interfaces in the VPC.
VPC Flow Logs is identified as the feature that captures detailed IP traffic details for network interfaces.
This is a native VPC feature specifically designed for network flow logging.
2
Analyze the second requirement: creating automated alarms based on metric thresholds and log events.
Amazon CloudWatch is identified as the service for collecting metrics, monitoring logs, and configuring alarms.
CloudWatch provides log monitoring (CloudWatch Logs) and automated alerting (CloudWatch Alarms) for custom operational thresholds.

Key Concept

Differentiating between network traffic logging (VPC Flow Logs) and resource monitoring/alerting (Amazon CloudWatch) versus API auditing (AWS CloudTrail) and vulnerability scanning (Amazon Inspector).
Rate this question

Topics

Security Logging, Monitoring, and Auditing

More questions from this topic