A security team is responsible for reviewing AWS API call activity in the cloud environment for security violations. These events must be recorded and retained in a centralized location for both…

Question

Options

• AConfigure Amazon CloudWatch Container Insights to collect and aggregate EKS application logs.
• BConfigure Amazon EKS to send application logs to Amazon CloudWatch. Create a CloudWatch
• CConfigure Amazon EKS to export logs to Amazon S3. Use Amazon Athena queries to analyze the
• DConfigure AWS App Mesh to monitor the traffic to the microservices in Amazon EKS. Integrate

• A
  8% (3)
• B
  76% (28)
• C
  14% (5)
• D
  3% (1)

Explanation

Enabling AWS CloudTrail with a trail applied to all regions and specifying a single S3 bucket for storage is the simplest method to record and retain API call activity for security analysis. This configuration ensures comprehensive coverage across all current and future AWS regions, centralizing log collection and simplification of log management. A company hosts its microservices application on Amazon Elastic Kubernetes Service (Amazon EKS). The company has set up continuous deployments to update the application on demand. A security engineer must implement a solution to provide automatic detection of anomalies in application logs in near real time. The solution also must send notifications about these anomalies to the security team. Which solution will meet these requirements? Create a CloudWatch alarm to monitor for anomalies. Configure the alarm to launch an AWS Lambda function to alert the security team when anomalies are detected. alarm based on a log group metric filter. Specify anomaly detection as the threshold type. Configure the alarm to use Amazon Simple Notification Service (Amazon SNS) to alert the logs for anomalies. Use Amazon QuickSight to visualize and monitor user access requests for anomalies. Configure Amazon Simple Notification Service (Amazon SNS) notifications to alert the App Mesh with AWS CloudTrail for logging. Use Amazon Detective to analyze the logs for anomalies and to alert the security team when anomalies are detected. Sending application logs from Amazon EKS to Amazon CloudWatch and configuring a CloudWatch alarm with anomaly detection on a log group metric filter provides near real-time monitoring and detection of anomalies in application logs. By setting the alarm threshold type to anomaly detection, CloudWatch can automatically identify unusual patterns. Configuring the alarm to use Amazon SNS ensures that the security team receives notifications when anomalies are detected, meeting the requirement for automatic detection and alerting with minimal operational overhead.

No community discussion yet for this question.