Q65 — AWS SAA-C03 Ch.15

Question 65 of 100 | ← Chapter 15

Q1165. A company uses AWS to host a public website. The load on the webservers recently increased.The company wants to learn more about the traffic flow and traffic sources. The company also wants to increase the overall security of the website.Which solution will meet these requirements?

Correct Answer: A. Deploy AWS WAF and set up logging. Use Amazon Data Firehose to deliver the log files to an Amazon S3 bucket for analysis.

Explanation

To meet the company's requirements of analyzing traffic flow and sources and increasing website security, the best solution is:Correct Answer:AA. Deploy AWS WAF and set up logging. Use Amazon Data Firehose to deliver the log files to an Amazon S3 bucket for analysis.Explanation:AWS WAF (Web Application Firewall):Provides protection against common web exploits (e.g., SQL injection, XSS, DDoS attacks). Allows fine-grained control over traffic (e.g., blocking malicious IPs, filtering requests). Logs traffic for analysis, which helps in understanding traffic patterns and sources.Logging with AWS WAF:WAF logs can be captured to analyze traffic (e.g., blocked requests, allowed requests, source IPs).Amazon Kinesis Data Firehose:Efficiently streams log data from AWS WAF (or other sources) to Amazon S3 for long-term storage and analysis.Can transform and compress logs before delivery to S3, reducing storage costs.Analysis in S3:Logs stored in S3 can be analyzed using Amazon Athena, QuickSight, or other tools to understand traffic patterns and security threats.Why Other Options Are Incorrect:B. Deploy Amazon API Gateway and set up logging. Use Amazon Kinesis Data Streams to deliver the log files to an Amazon S3 bucket for analysis.API Gateway is for RESTful APIs, not public websites. The question describes a public website, so API Gateway is not suitable here.C. Deploy a Network Load Balancer (NLB) and set up logging. Use Amazon Data Firehose to deliver the log files to an Amazon S3 bucket for analysis.NLB operates at Layer 4 (TCP/UDP) and does not provide application-layer (HTTP/HTTPS) logging or security features like WAF.NLB logs are limited and not as useful for analyzing traffic sources or security threats. D. Deploy an Application Load Balancer (ALB) and set up logging. Use Amazon Kinesis Data Streams to deliver the log files to an Amazon S3 bucket for analysis. While ALB provides HTTP/HTTPS logging (via Access Logs), it does not inherently offer security features like WAF.Kinesis Data Streams is more complex than needed for log delivery compared to Kinesis Data Firehose, which is optimized for streaming to S3.WAF + ALB could be a good combination for security, but the question asks for a single solution, and WAF + Firehose is more focused on security and logging.Key Takeaways:AWS WAF is essential for security and traffic analysis.Kinesis Data Firehose is the best choice for efficiently streaming logs to S3 (simpler and cheaper than Kinesis Data Streams for this use case).ALB could be used alongside WAF for better HTTP/HTTPS security, but the question expects a standalone solution, and WAF + Firehose directly addresses both requirements.Final Answer:A. Deploy AWS WAF and set up logging. Use Amazon Data Firehose to deliver the log files to an Amazon S3 bucket for analysis.