AWS Certified Associate SOA-C02 Exam Dumps

To centrally store traffic logs for a website delivered through Amazon CloudFront and ensure all data is encrypted at rest, using an S3 bucket with default server-side encryption is the optimal solution.

Create an S3 Bucket:

Open the Amazon S3 console at Amazon S3 Console.

Create a new S3 bucket for storing the logs.

Enable Default Encryption:

Select the S3 bucket, navigate to Properties, and enable Default encryption.

Choose AES-256 for server-side encryption.

Configure CloudFront Logging:

Open the Amazon CloudFront console at Amazon CloudFront Console.

Select the CloudFront distribution and navigate to Edit.

In the logging section, enable logging and specify the S3 bucket created for log storage.

This setup ensures that all logs are encrypted at rest using AES-256 and stored centrally in an S3 bucket.

References:

Amazon CloudFront Access Logs

Amazon S3 Default Encryption

https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html In governance mode, users can 't overwrite or delete an object version or alter its lock settings unless they have special permissions. With governance mode, you protect objects against being deleted by most users, but you can still grant some users permission to alter the retention settings or delete the object if necessary. You can also use governance mode to test retention-period settings before creating a compliance-mode retention period. In compliance mode, a protected object version can't be overwritten or deleted by any user, including the root user in your AWS account. When an object is locked in compliance mode, its retention mode can't be changed, and its retention period can't be shortened. Compliance mode helps ensure that an object version can't be overwritten or deleted for the duration of the retention period.

Aurora Global Databases are designed for cross-Region disaster recovery with very low RPO, meeting the 20-second requirement. Setting up Aurora as a global database with the correct configuration ensures low-latency replication and rapid failover, making it ideal for compliance with strict disaster recovery requirements.

https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html#flow-log-example-accepted-rejected

https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html#

Accepted and rejected traffic: In this example, RDP traffic (destination port 3389, TCP protocol) to network interface eni-1235b8ca123456789 in account 123456789010 was rejected. 2 123456789010 eni-1235b8ca123456789 172.31.9.69 172.31.9.12 49761 3389 6 20 4249 1418530010 1418530070 REJECT OK