A company’s DevOps engineer is working in a multi-account environment. The company uses AWS Transit Gateway to route all outbound traffic through a network operations account. In the network operations account, all account traffic passes through a firewall appliance for inspection before the traffic goes to an internet gateway. The firewall appliance sends logs to Amazon CloudWatch Logs and includes event severities of CRITICAL, HIGH, MEDIUM, LOW, and INFO. The security team wants to receive an alert if any CRITICAL events occur. What should the DevOps engineer do to meet these requirements?
Select one answer.
Marked answer: B
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose B1
I think B
Chose B2
answer B
4
B is correct: <firewall appliance sends logs to Amazon CloudWatch Logs> means we already have the log in CW logs, only need to create alarm on these log files and send to sends A: No need to monitor the state of the firewall C and D: no mention of CloudWatch Logs
5
B. As the appliance pipes to CW Logs for consolidation. Define an alarm listening to the metric and should be okay. D is ONLY CORRECT IF YOU ARE USING AWS FIREWALL MANAGER.
