DOP-C02 · Question #364
A company runs a web application on Amazon Elastic Kubernetes Service (Amazon EKS). The company uses Amazon CloudFront to distribute the application. The company recently enabled AWS WAF. The company
The correct answer is A. Create a CloudWatch Logs metrics filter for blocked requests on the AWS WAF log group to. CloudWatch Logs metrics filter: By creating a metrics filter specifically for blocked requests in the AWS WAF log group, you can generate a custom metric that reflects only the relevant traffic being blocked, isolating it from other log behaviors. CloudWatch anomaly detection: Us
Question
A company runs a web application on Amazon Elastic Kubernetes Service (Amazon EKS). The company uses Amazon CloudFront to distribute the application. The company recently enabled AWS WAF. The company set up Amazon CloudWatch Logs to send logs to an aws-waf-logs log group. The company wants a DevOps engineer to receive alerts if there are sudden changes in blocked traffic. The company does not want to receive alerts for other changes in AWS WAF log behavior. The company will tune AWS WAF rules over time. The DevOps engineer is currently subscribed to an Amazon Simple Notification Service (Amazon SNS) topic in the environment. Which solution will meet these requirements?
Options
- ACreate a CloudWatch Logs metrics filter for blocked requests on the AWS WAF log group to
- BCreate a CloudWatch anomaly detector for the log group. Create a CloudWatch alarm by using
- CCreate a CloudWatch metrics filter for counted requests on the AWS WAF log group to create a
- DCreate a CloudWatch anomaly detector for the log group. Create a CloudWatch alarm by using
How the community answered
(24 responses)- A83% (20)
- B4% (1)
- C8% (2)
- D4% (1)
Explanation
CloudWatch Logs metrics filter: By creating a metrics filter specifically for blocked requests in the AWS WAF log group, you can generate a custom metric that reflects only the relevant traffic being blocked, isolating it from other log behaviors. CloudWatch anomaly detection: Using CloudWatch anomaly detection on this custom metric allows for the identification of sudden changes in blocked traffic patterns without being affected by normal fluctuations or rule tuning, addressing the requirement to alert only on significant changes. SNS notifications: Configuring the alarm to notify the SNS topic ensures that the DevOps engineer receives timely alerts about any unexpected spikes in blocked traffic, aligning with the company's alerting strategy.
Topics
Community Discussion
No community discussion yet for this question.