Answer-first summary for fast verification
Answer: Configure the AWS WAF web ACL to deliver logs to an Amazon Kinesis Data Firehose delivery stream. Configure the stream to deliver the data to an Amazon S3 bucket for log analysis.
To analyze application attacks detected by AWS WAF using Amazon Athena, the logs generated by AWS WAF need to be stored in an Amazon S3 bucket. This is because Amazon Athena can directly query data stored in S3. Option C is the correct choice because it specifically mentions configuring the AWS WAF web ACL to deliver logs to an Amazon Kinesis Data Firehose delivery stream, which is then configured to deliver the data to an Amazon S3 bucket. This setup allows for the logs to be stored in S3, making them accessible for analysis with Amazon Athena. The other options do not directly address the requirement of analyzing AWS WAF logs with Amazon Athena. Option A deals with VPC flow logs, which are not related to AWS WAF logs. Option B involves AWS CloudTrail, which is used for auditing API calls and not for WAF logs. Option D involves ALB access logs, which, while useful for analyzing traffic to the ALB, do not provide the specific WAF log data needed for this analysis.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
A company operates a web application on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB), with the instances managed by an Auto Scaling group. The application uses an Amazon CloudFront distribution with the ALB as its origin. Following a recent attack, the company associated an AWS WAF web ACL with the CloudFront distribution. To analyze application attacks detected by AWS WAF, the company wants to use Amazon Athena. What solution will fulfill this requirement?
A
Configure the ALB and the EC2 instance subnets to produce VPC flow logs. Configure the VPC flow logs to deliver logs to an Amazon S3 bucket for log analysis.
B
Create a trail in AWS CloudTrail to capture data events. Configure the trail to deliver logs to an Amazon S3 bucket for log analysis.
C
Configure the AWS WAF web ACL to deliver logs to an Amazon Kinesis Data Firehose delivery stream. Configure the stream to deliver the data to an Amazon S3 bucket for log analysis.
D
Turn on access logging for the ALB. Configure the access logs to deliver the logs to an Amazon S3 bucket for log analysis.
No comments yet.