A company has deployed an application in a production VPC in a single AWS account. The application is popular and is experiencing heavy usage. The company’s security team wants to add additional security, such as AWS WAF, to the application deployment. However, the application's product manager is concerned about cost and does not want to approve the change unless the security team can prove that additional security is necessary. The security team believes that some of the application's demand might come from users that have IP addresses that are on a deny list. The security team provides the deny list to a DevOps engineer. If any of the IP addresses on the deny list access the application, the security team wants to receive automated notification in near real time so that the security team can document that the application needs additional security. The DevOps engineer creates a VPC flow log for the production VPC. Which set of additional steps should the DevOps engineer take to meet these requirements MOST cost-effectively?
Select one answer.
Marked answer: A
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
2
A is correct: push all VPC flow log to cloudwatch logs. Create metric filter to find denied IP addresses. Create cloudwatch alarm with the metric filter as input. Alarm's action is send noti to Security team via SNS B: "Configure the alert to automatically notify the security team": alert cannot notify by itself. Must use SNS C: This option uses both S3 bucket and "Amazon OpenSearch Service cluster" to store log files, which would cost a lot of money and unnecessary D: This option uses both S3 bucket and VPC flow log to store log files, which is costly
1
This answer is for a previous question
Chose A5
opensearch cost a lot of $$$. Athena got tons of things to do afterwards. It's used purely for interactive query. natively, vpcflow sends logs to s3 or cloudwatch logs. no brainer answer
