Exam AWS Certified Advanced Networking - Specialty ANS-C01 topic 1 question 154 discussion

C To send logs to Amazon Kinesis Data Firehose, you send logs from your web ACL to an Amazon Kinesis Data Firehose with a configured storage destination. After you enable logging, AWS WAF delivers logs to your storage destination through the HTTPS endpoint of Kinesis Data Firehose.

A Kinesis Data Firehose delivery stream is used to receive log records from AWS WAF. An IAM role for the Kinesis Data Firehose delivery stream, with permissions needed to invoke Lambda and write to S3. A Lambda function used to filter out WAF records matching the default action before the records are written to S3. An IAM role for the Lambda function, with the permissions needed to create CloudWatch logs (for troubleshooting). An S3 bucket where the WAF logs will be stored.

The big thing here is that according to the scenario the WAF ist attached to CloudFront, so looking at ALB is "too late" ;) With this being said it can only be C

Options A and D suggest using VPC flow logs and ALB access logs, respectively. While these logs are valuable for specific purposes (network analysis and access patterns), they do not capture the detailed information about web requests and attacks that are logged by AWS WAF. Option B involves AWS CloudTrail, which is more focused on auditing API calls rather than capturing detailed web request information. Therefore, for analyzing application attacks detected by AWS WAF, configuring AWS WAF logs to be delivered to an Amazon Kinesis Data Firehose stream is the recommended approach.

agreed - C