SCS-C03 · Question #122
A company's web application is hosted on Amazon EC2 instances running behind an Application Load Balancer (ALB) in an Auto Scaling group. An AWS WAF web ACL is associated with the ALB. AWS…
The correct answer is D. Configure the web ACL to send logs to Amazon Data Firehose, which delivers the logs to an S3. AWS WAF logs capture detailed request-level information, including source IP address, request URI, headers, and rule evaluation results. According to the AWS Certified Security - Specialty documentation, AWS WAF logging is a critical detection control when application-level…
Question
A company's web application is hosted on Amazon EC2 instances running behind an Application Load Balancer (ALB) in an Auto Scaling group. An AWS WAF web ACL is associated with the ALB. AWS CloudTrail is enabled and stores logs in Amazon S3 and Amazon CloudWatch Logs. The operations team has observed some EC2 instances reboot at random. After rebooting, all access logs on the instances have been deleted. During an investigation, the operations team found that each reboot happened just after a PHP error occurred on the new-user-creation.php file. The operations team needs to view log information to determine if the company is being attacked. Which set of actions will identify the suspect attacker's IP address for future occurrences?
Options
- AConfigure VPC Flow Logs on the subnet where the ALB is located and stream the data to
- BConfigure the CloudWatch agent on the ALB and send application logs to CloudWatch Logs.
- CConfigure the ALB to export access logs to an Amazon OpenSearch Service cluster and search
- DConfigure the web ACL to send logs to Amazon Data Firehose, which delivers the logs to an S3
How the community answered
(64 responses)- A11% (7)
- B5% (3)
- C3% (2)
- D81% (52)
Explanation
AWS WAF logs capture detailed request-level information, including source IP address, request URI, headers, and rule evaluation results. According to the AWS Certified Security - Specialty documentation, AWS WAF logging is a critical detection control when application-level attacks are suspected, especially when host-based logs are unreliable or can be erased by attackers. By configuring the AWS WAF web ACL to send logs to Amazon Data Firehose, the company ensures that all future requests are centrally captured and delivered to a durable storage service such as Amazon S3. Using Amazon Athena, the security team can query these logs to identify requests targeting specific application paths such as new-user-creation.php and extract the originating client IP addresses.
Topics
Community Discussion
No community discussion yet for this question.