Exam AWS Certified Security - Specialty topic 1 question 63 discussion

A D F are correct answers, you isolate using security groups and investigate using VPV logs and cloud trial

ADF my answer

ADF. To isolate and have services that provides information. Athena is a useful service, but not a source of information like CloudTrail and VPC Flow Logs. We need to know what external parties the instance has been in contact with (VPC Flow Logs), and what actions and API calls the instance issued (CloudTrail).

isolate --> Security group research this event --> Cloudtrail & VPV logs However, CloudTrail determines who accesses your AWS account whereas VPC Flow Logs determines who accesses your VMs.

Why is CLoudtrail used? Could'nt it be VPC Flow logs + Athena for analysis? And the SG to isolate the instance

A. Cloudtrail for log analyses B. Athena for search queries F. Security group for Isolation.

ADF makes the most sense

ADF are correct. If you are checking a recent issue you can check it directly from the console without using Athena. Here you can see how to proceed and which services are useful for forensic -> https://aws.plainenglish.io/basic-services-and-actions-for-forensic-investigation-in-aws-dbd04188bbe7

Question asked what should be used to analyze, which is Athena targeted to S3 bucket of VPC Flow Logs after isolating with security group. You can't analyze anything with CloudTrail, and if you did, it would be account API activity, not EC2 traffic.

Cloud trail and box logs for analysis and Sh for isolation

Isolate with Security groups and investigate using cloud trails and Athena.

A, D, F 1. Isolate instance = adjust security groups 2. collect and check logs -- VPC flow logs for network traffic -- Cloudtrail for other traffic - API calls etc. Optional: Finally review data = Cloudtrail should be fine by itself, but if you needed to collect a lot of log data, say over a week, then i'd recommend using athena to query the data structure.

A, D and F you need flow logs to research this incident

A. AWS CloudTrail B. Amazon Athena F. Security groups You use security groups to isolate, then use query cloudtrail using athena: Using Athena with CloudTrail logs is a powerful way to enhance your analysis of AWS service activity. For example, you can use queries to identify trends and further isolate activity by attributes, such as source IP address or user. https://docs.aws.amazon.com/athena/latest/ug/cloudtrail-logs.html

BDF - https://medium.com/binbash-inc/network-monitoring-use-aws-athena-to-query-vpc-flow-logs-66a9dc7043bc

adf ad investigate f isolate

Ans: ADF 100%