ALB Access Logging with Amazon Athena

SAA-C03 By islever Editorial Last updated

Determine high-performing and/or scalable network architectures.

Short answer

B Enable ALB access logging to Amazon S3 and create an Amazon Athena table to query the logs for abnormal traffic patterns.

Question

A company is using an Application Load Balancer (ALB) to present its application to the internet. The company finds abnormal traffic access patterns across the application. A solutions architect needs to improve visibility into the infrastructure to help the company understand these abnormalities better. What is the MOST operationally efficient solution that meets these requirements?
  1. Create a table in Amazon Athena for AWS CloudTrail logs. Create a query for the relevant information.
  2. Enable ALB access logging to Amazon S3. Create a table in Amazon Athena, and query the logs. Correct Answer
  3. Enable ALB access logging to Amazon S3. Open each file in a text editor, and search each line for the relevant information.
  4. Use Amazon EMR on a dedicated Amazon EC2 instance to directly query the ALB to acquire traffic access log information.

Key Takeaways

The question tests the ability to select the most operationally efficient tool for analyzing web server logs, highlighting the common trap of confusing ALB request logs with AWS CloudTrail API activity.

This page explains how to use Application Load Balancer access logs stored in S3 and queried via Amazon Athena for operational efficiency. It establishes why this combination is superior to manual analysis or API-level logging for traffic visibility.

Common mistake: Many learners choose option A (CloudTrail) because they associate it with monitoring, but CloudTrail records API calls, not HTTP traffic patterns, making it irrelevant for analyzing abnormal access patterns.

Expert Analysis

Why the Answer Is Correct

Enabling ALB access logging to Amazon S3 allows the capture of detailed HTTP/HTTPS requests, including source IP, latency, and status codes. Using Amazon Athena to query these logs provides a serverless, SQL-based interface that eliminates the need to provision infrastructure or manually parse files. This combination is the most operationally efficient solution as it requires zero management overhead while providing powerful analytical capabilities.

Why the Other Options Are Wrong

Option A is incorrect because AWS CloudTrail logs API calls made to AWS services, not the actual application traffic passing through an ALB. Option C is inefficient because manually opening and searching text files does not scale and is prone to human error. Option D is overly complex and costly, requiring the provisioning and management of EC2 instances and EMR clusters for a task that can be done serverlessly with Athena.

Community Comment Notes

Community consensus strongly supports B, with users noting that CloudTrail is for API calls rather than traffic logs. One user highlighted the definition of Athena as an interactive query service for data in S3. Another comment pointed out that manual file searching (Option C) is not operationally efficient, reinforcing the choice of a automated query tool.

Official Reference

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked for 'operational efficiency' in log analysis, prefer managed, serverless tools like Athena over manual processes or self-managed compute like EMR. Always distinguish between control plane events (CloudTrail) and data plane events (Access Logs).

Frequently Asked Questions

Why can't I use CloudTrail for ALB traffic?

CloudTrail logs API calls to AWS services, not the HTTP requests processed by the ALB. For traffic visibility, you must use ALB access logs.

Is Athena more efficient than EMR for this task?

Yes. Athena is serverless and requires no infrastructure management, whereas EMR requires provisioning and managing EC2 instances and clusters.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. Marunio 👍 9 Answered B
    A - Cloudtrail is for API Calls and changes on AWS account. B - Going for athena in S3. - Correct C - Manual work D - Distractor
  2. Naveena_Devanga 👍 5
    B - Amazon Athena is an interactive query service that makes it easy to analyze data directly in Amazon Simple Storage Service (Amazon S3) using standard SQL.
  3. c48b4e2 👍 2
    Why there is a "Correct answer" (the green bordered one) at all while most of the time the community thinks (correctly) otherwise?
  4. Salilgen 👍 1 Answered B
    https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html
  5. Andy_09 👍 11
    B is the correct answer
Show 2 more comments
  1. betttty 👍 3
    why not A?
  2. Scheldon 👍 2 Answered B
    Answer B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide