Examkin

Soru

Zorluk: KolayVPC Security Controls and Traffic Analysis

A SysOps Administrator is configuring a VPC Flow Log to capture network traffic from a subnet and deliver it to an Amazon CloudWatch Logs log group. The administrator has already created the target log group and an IAM role with the necessary permissions for the VPC Flow Logs service to publish logs. However, during the creation process, the administrator receives an 'Access Denied' error. In addition, the administrator wants to ensure that the logs do not persist indefinitely to manage storage costs.

Which of the following actions should the administrator take to resolve the error and manage log retention? (Select TWO.)

  1. Add the iam:PassRole permission to the IAM policy of the user creating the flow log, referencing the flow log IAM role.Cevap
  2. Configure a retention period on the CloudWatch Logs log group in the CloudWatch console.Cevap
  3. C
    Add the iam:PassRole permission directly to the trust policy of the flow log IAM role.
  4. D
    Specify a log retention period in the VPC Flow Log configuration settings during creation.
  5. E
    Enable detailed monitoring on the EC2 instances in the subnet to automatically archive flow logs after 14 days.

Cevap

Add the iam:PassRole permission to the IAM policy of the user creating the flow log, referencing the flow log IAM role, and configure a retention period on the CloudWatch Logs log group in the CloudWatch console.
To resolve the Access Denied error, the user creating the flow log must be granted the `iam:PassRole` permission in their IAM policy for the role that the VPC Flow Logs service will assume. To control log storage costs, a retention period must be configured on the CloudWatch Logs log group since the default setting is to keep logs indefinitely.

Adım Adım Çözüm

1
Analyze the 'Access Denied' error during flow log creation.
Identify that the administrator's IAM identity lacks the permission to pass the flow log service role to the VPC Flow Logs service.
VPC Flow Logs requires the user to have iam:PassRole permissions on the IAM role being passed to the service.
2
Address the log storage cost requirement.
Determine that logs should have a configured expiration policy rather than remaining indefinitely.
By default, CloudWatch log groups retain logs indefinitely. Setting a retention policy deletes old log events and limits ongoing storage fees.
3
Combine the resolutions into the final answer.
Select the option to add the iam:PassRole permission to the creator's IAM policy and the option to configure a retention period on the target CloudWatch Logs log group.
These two steps directly resolve the permission block and address the cost requirement.

Anahtar Kavram

Configuring VPC Flow Logs requires proper IAM permissions (such as iam:PassRole) to allow the flow logs service to assume the logging role, while cost management for CloudWatch Logs requires setting log group retention periods.
Bu soruyu puanla

Konular

VPC Security Controls and Traffic Analysis

Bu konudan daha fazla soru