SCS-C02 Security Logging and Monitoring Practice Question

A security engineer is designing a logging solution for an application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The engineer needs to capture and store the following logs for analysis: (1) HTTP request logs from the ALB, (2) operating system logs from the EC2 instances, and (3) network traffic logs for the VPC. Which combination of AWS services should the engineer use? (Choose three.)

⚠ Common exam trap

Candidates often confuse CloudTrail with VPC Flow Logs or ALB access logs, not realizing CloudTrail only captures management plane API calls, not data plane logs like HTTP requests or network traffic.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable access logging on the ALB and store logs in an S3 bucket.

ALB access logging captures detailed HTTP request data (method, URI, status code, user agent, etc.) and can be directly configured to store logs in an S3 bucket without additional agents or infrastructure. This satisfies the requirement for HTTP request logs from the ALB.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Enable access logging on the ALB and store logs in an S3 bucket.
Why this is correct
ALB access logging is the correct choice because it records detailed HTTP request data—method, URI, requester IP, user agent, latency, and the ALB's response code—for every request the load balancer processes. Since an ALB sits in front of the application's EC2 or container targets, enabling this access log and delivering it to an S3 bucket directly captures the application-level request telemetry needed to analyze client traffic patterns, troubleshoot HTTP errors, and support security investigations.
✓
Enable VPC Flow Logs to capture network traffic metadata.
Why this is correct
VPC Flow Logs is a correct complementary source because it captures metadata about IP traffic at the elastic network interface level, including source and destination IPs, ports, protocol, and accept/reject decisions from security groups and network ACLs. While ALB access logs show HTTP semantics, VPC Flow Logs reveal the actual network path behavior—for example, whether a request was allowed or blocked by a security group or NACL before it ever reached the ALB or an EC2 instance.
✗
Enable S3 server access logging for the application's S3 buckets.
Why it's wrong here
S3 server access logging is not appropriate for this scenario because it only records requests made to an S3 bucket itself, such as GET, PUT, or LIST operations against the bucket, and it produces a log object per request written to a destination bucket. The application's S3 buckets might hold artifacts or user uploads, but S3 server access logs would never capture inbound HTTP traffic to the ALB or network flows between an EC2 instance and other hosts, so it cannot serve as the requested logging solution for the application's network and request activity.
✗
Enable AWS CloudTrail to capture API calls.
Why it's wrong here
CloudTrail is the wrong choice because it records AWS management and data-plane API calls—who made the call, from which IP address, when, and what parameters were sent—primarily for auditing IAM permissions and changes to AWS resources. Although CloudTrail can show that an EC2 instance was launched or an ALB was modified, it does not capture the application's HTTP requests that the ALB forwards, nor does it log OS-level system logs or raw network traffic, so it leaves a critical visibility gap for troubleshooting application-level failures.
✓
Install the CloudWatch Logs agent on EC2 instances to send OS logs to CloudWatch Logs.
Why this is correct
Installing the CloudWatch Logs agent (or the newer unified CloudWatch agent) on EC2 instances is a correct component because it ships OS-level logs—such as /var/log/messages, /var/log/syslog, application logs, and Windows Event Logs—to CloudWatch Logs. This provides the operating-system perspective of what happened inside the instances, complementing the ALB's external HTTP view and VPC Flow Logs' network metadata, but it cannot replace those sources because it will never see traffic that was blocked before reaching the instance or requests handled by the ALB when the target instance is unhealthy.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Security Logging and Monitoring Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question