Q84 — AWS SAA-C03 Ch.11

Question 84 of 100 | ← Chapter 11

Q784. A company is using an Application Load Balancer (ALB) to present its application to the internet. The company finds abnormal traffic access patterns across the application. A solutions architect needs to improve visibility into the infrastructure to help the company understand these abnormalities better.What is the MOST operationally efficient solution that meets these requirements?

• A. Create a table in Amazon Athena for AWS CloudTrail logs. Create a query for the relevant information.
• B. Enable ALB access logging to Amazon S3. Create a table in Amazon Athena, and query the logs. ✓
• C. Enable ALB access logging to Amazon S3. Open each file in a text editor, and search each line for the relevant information.
• D. Use Amazon EMR on a dedicated Amazon EC2 instance to directly query the ALB to acquire traffic access log information.

Correct Answer: B. Enable ALB access logging to Amazon S3. Create a table in Amazon Athena, and query the logs.

Explanation

To improve visibility into the infrastructure and better understand abnormal traffic access patterns in an Application Load Balancer (ALB), the most operationally efficient solution is:B. Enable ALB access logging to Amazon S3. Create a table in Amazon Athena, and query the logs.Enabling ALB access logging to Amazon S3 allows you to capture detailed access logs for your ALB. These logs contain information about each request made to the ALB, including the source IP address, request timestamp, response status code, and more. By storing the logs in Amazon S3, you have a centralized and durable location for storing and analyzing the logs.Creating a table in Amazon Athena, a serverless query service, allows you to query and analyze the ALB access logs directly from S3 using SQL. This provides an efficient and flexible way to gain insights into the abnormal traffic access patterns. You can write queries to filter and aggregate the logs based on specific criteria, enabling you to identify patterns and anomalies more effectively.Here's why the other options are not the most operationally efficient choices:A. Creating a table in Amazon Athena for AWS CloudTrail logs: AWS CloudTrail logs provide information about API activity in your AWS account, but they may not provide the necessary details about ALB traffic access patterns. Using CloudTrail logs would not be the most efficient solution for understanding abnormal traffic specifically related to the ALB.C. Enabling ALB access logging to Amazon S3 and manually searching each file: Manually opening each log file in a text editor and searching for relevant information is time-consuming and inefficient, especially when dealing with a large volume of logs. It is not a scalable solution and does not provide the same level of flexibility and query capabilities as using Amazon Athena.D. Using Amazon EMR on a dedicated Amazon EC2 instance to query the ALB: Amazon EMR is a big data processing service, which may be overkill for analyzing ALB access logs. It requires setting up and managing an EMR cluster and EC2 instances, which introduces additional operational overhead. Using a serverless service like Amazon Athena is a more operationally efficient option.Therefore, the most operationally efficient solution to improve visibility into the infrastructure and understand abnormal traffic access patterns in an ALB is:B. Enable ALB access logging to Amazon S3. Create a table in Amazon Athena, and query the logs.