During a Manual Review of System Logs from an Amazon

question 149

Multiple Choice

During a manual review of system logs from an Amazon Linux EC2 instance, a Security Engineer noticed that there are sudo commands that were never properly alerted or reported on the Amazon CloudWatch Logs agent. Why were there no alerts on the sudo commands?

• A) There is a security group blocking outbound port 80 traffic that is preventing the agent from sending the logs.
• B) The IAM instance profile on the EC2 instance was not properly configured to allow the CloudWatch Logs agent to push the logs to CloudWatch.
• C) CloudWatch Logs status is set to ON versus SECURE, which prevents if from pulling in OS security event logs.
• D) The VPC requires that all traffic go through a proxy, and the CloudWatch Logs agent does not support a proxy configuration.

---

Definitions:

T Test

A statistical test used to compare the means of two groups and determine if there are statistically significant differences between them.

Pooled Standard Deviation

A method for calculating the overall standard deviation from multiple samples or groups, combining variances to assess overall variability.

Cohen's D

A measure of the standardized difference between two means, commonly used in the context of effect size in statistics.

Effect Size

A quantitative measure of the magnitude of the difference between groups or the size of a relationship between variables.