Task 1.3: Troubleshoot security monitoring, logging, and alerting solutions

• ARun the agent control script with fetch-config to load the updated file

  Correct

  After the configuration file changes, the agent must be started with fetch-config to pick up the new configuration.

• BAdd the logs:PutRetentionPolicy permission to the instance role

  Incorrect

  This permission is needed only if the agent sets retention on its log groups. The managed policy already lets the agent send logs.

• CRaise the instance metadata hop limit to 2 on the instances

  Incorrect

  The hop limit matters when the agent runs in a container and cannot reach instance metadata, which is not the case here.

• DReboot the instances so that the agent service starts again with the file

  Incorrect

  A restart runs the configuration the agent fetched last. The changed file is applied only through fetch-config.

Other logs still arriving rules out permissions and connectivity. What is left is the agent running an old configuration.

• ATurn on access logging for the eu-west-1 stage with a destination log group

  Incorrect

  Access logging and execution logging are configured independently. Adding access logs does not make execution logs appear.

• BAdd a resource policy to the API that allows the CloudWatch Logs service principal

  Incorrect

  An API resource policy controls who can invoke the API. It does not give API Gateway permission to write logs.

• CAdd CloudWatch Logs permissions to the execution role of the Lambda function behind the API

  Incorrect

  That role controls the function's own logging, not the logs that API Gateway writes about requests.

• DSet the CloudWatch Logs role ARN in the API Gateway account settings for eu-west-1

  Correct

  API Gateway writes logs by assuming the role in the account's cloudWatchRoleArn setting, which must be set separately in each Region.

When logging works in one Region but not another with the same template, look for a per-Region account setting that the template does not manage.

• AThe role does not trust vpc-flow-logs.amazonaws.com

  Correct

  The flow logs service must be able to assume the role, so its trust policy must name that service principal.

• BFlow logs can be published only to S3, not CloudWatch Logs

  Incorrect

  Flow logs can publish to a CloudWatch Logs log group, with a log stream for each network interface.

• CFlow logs to CloudWatch Logs require a KMS key

  Incorrect

  Encryption with a KMS key is optional for log groups.

• DThe subnets must have an internet gateway

  Incorrect

  Flow log delivery does not depend on the VPC's internet access.

Service roles need two halves: a trust policy for the service and a permissions policy for the actions.

• AGuardDuty needs DNS logs from the default AWS DNS resolvers

  Correct

  GuardDuty processes Route 53 Resolver DNS logs only when instances use the AWS DNS resolvers; other resolvers are not visible to it.

• BVPC Flow Logs must be turned on for those subnets first

  Incorrect

  GuardDuty reads flow log data through its own stream without flow logs turned on; DNS findings depend on the DNS data source.

• CThe instances lack the GuardDuty security agent

  Incorrect

  DNS findings do not need an agent on the instance.

• DGuardDuty only analyzes DNS for instances in public subnets

  Incorrect

  Subnet type is not the reason; the resolver in use is.

Custom resolvers are a common blind spot; Route 53 Resolver forwarding rules keep GuardDuty's view while reaching on-premises DNS.

• AThe account has no CloudTrail trail at all

  Incorrect

  Most controls are evaluated with AWS Config rules, not with trails.

• BGuardDuty has not been turned on in the account

  Incorrect

  Controls do not depend on GuardDuty.

• CThe account needs AWS Business Support

  Incorrect

  Control checks do not depend on a support plan.

• DAWS Config is not recording in the account

  Correct

  Security Hub CSPM uses AWS Config rules for most controls, which need a configuration recorder.

When Security Hub CSPM runs without AWS Security Hub, turn on AWS Config recording for the resource types the controls need, before or together with Security Hub CSPM. With both services enabled, Security Hub CSPM creates a service-linked configuration recorder for you.

• AThe alarm must be created in the us-east-1 Region

  Incorrect

  Alarms work in the Region of the metric; this is about the filter.

• BMetric filters only work on encrypted log groups

  Incorrect

  Encryption has nothing to do with metric filters.

• CThe trail must be a single-Region trail instead

  Incorrect

  The trail type does not affect metric filters on its log group.

• DFilters ignore events from before they were created

  Correct

  Filters publish data points only for events that arrive after the filter is created.

To test a new filter, generate a test event or use the filter pattern test feature on sample data.

• AThat the ALB uses an HTTPS listener for traffic

  Incorrect

  Access logs work for HTTP and HTTPS listeners alike.

• BThat the bucket has S3 Object Lock turned on

  Incorrect

  Object Lock is not required for log delivery.

• CThat CloudTrail data events are on for the bucket

  Incorrect

  Data events record S3 API calls; they are not needed for delivery.

• DThat the bucket policy lets the load balancer write

  Correct

  The bucket must have a policy that grants Elastic Load Balancing permission to write the logs.

After you turn on logging, the load balancer writes a test file; its absence points to the bucket policy.