Question
HOTSPOT -
A company is designing its security monitoring strategy for an existing sensitive workload on AWS. The security team has identified several scenarios that require monitoring strategies.
Select the correct monitoring scenario from the following list for each monitoring strategy. Select each monitoring scenario one time or not at all.
Explanation
VPC Flow Logs combined with CloudWatch Logs Insights are used for analyzing network traffic, making them ideal for monitoring unusual data transfer activities outside of regular working hours and identifying large data transfers to external IPs. CloudWatch metric filters on application logs help in tracking failed authentication attempts by aggregating hourly data from specific IP addresses. AWS CloudTrail Insights is effective for detecting anomalous API activity patterns by establishing baselines of normal behavior, which helps in spotting when privileged users delete resources at an unusually high rate. AWS Security Hub custom insights with EventBridge rules automate the response to security findings from multiple services, enabling the identification and mitigation of multi-stage attacks through coordinated incident response mechanisms.
