A company's web application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. An AWS WAF web ACL is associated with the ALB. Instance logs are lost…

Question

Options

• AConfigure VPC Flow Logs and search for PHP file activity.
• BInstall the CloudWatch agent on the ALB and export application logs.
• CExport ALB access logs to Amazon OpenSearch Service and search them.
• DConfigure the web ACL to send logs to Amazon Kinesis Data Firehose. Deliver logs to Amazon

• A
  13% (3)
• B
  4% (1)
• C
  4% (1)
• D
  79% (19)

Explanation

AWS WAF logs contain detailed request-level information, including source IP addresses, requested URIs, and rule matches. According to AWS Certified Security - Specialty guidance, enabling AWS WAF logging provides the most reliable and tamper-resistant method to investigate web-based attacks, especially when instance-level logs are unavailable. By streaming WAF logs through Amazon Kinesis Data Firehose to Amazon S3, the company ensures durable, centralized log storage that is independent of EC2 lifecycle events. Amazon Athena can then query the logs efficiently to identify repeated requests to the new-user- creation.php endpoint and extract attacker IP addresses. VPC Flow Logs do not capture HTTP-level details. ALB access logs alone may not capture blocked requests. WAF logs provide the best forensic visibility for future detection.

No community discussion yet for this question.