AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 70

Question

A company has a group of Amazon EC2 instances in a single private subnet of a VPC with no internet gateway attached. A security engineer has installed the Amazon CloudWatch agent on all instances in that subnet to capture logs from a specific application. To ensure that the logs flow securely, the company's networking team has created VPC endpoints for CloudWatch monitoring and CloudWatch logs. The networking team has attached the endpoints to the VPC. The application is generating logs However, when the security engineer queries CloudWatch, the logs do not appear. Which combination of steps should the security engineer take to troubleshoot this issue? (Choose three.)

Accepted Answer

Correct answer: A, C, D. The correct answer is A, C, D. Option A: Ensure that the EC2 instance profile that is attached to the EC2 instances has permissions to create log streams and write logs. Option C: Check the CloudWatch agent configuration file on each EC2 instance to make sure that the CloudWatch agent is collecting the proper log files. Option D: Check the VPC endpoint policies of both VPC endpoints to ensure that the EC2 instances have permissions to use them. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. A VPC endpoint provides private connectivity to AWS services without traversing the public internet. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

AWS Certified Security - Specialty SCS-C02 — Question 70