AWS Certified SysOps Administrator – Associate (legacy) — Question 403

A company has Amazon EC2 instances that serve web content behind an Elastic Load Balancing (ELB) load balancer. The ELB Amazon CloudWatch metrics from a few hours ago indicate a significant number of 4XX errors. The EC2 instances from the time of these errors have been deleted.
At the time of the 4XX errors, how can an Administrator obtain information about who originated these requests?

Answer options

• A. If ELB access logs have been enabled, the information can be retrieved from the S3 bucket
• B. Contact AWS Support to obtain application logs from the deleted instances
• C. Amazon S3 always keeps a backup of application logs from EC2 instances. Retrieve these logs for analysis
• D. Use AWS Trusted Advisor to obtain ELB access logs

Correct answer: A

Explanation

ELB access logs capture detailed information about requests sent to the load balancer, including the client's IP address, and store these logs in a user-specified Amazon S3 bucket if the feature is enabled. Because the EC2 instances have been deleted, local application logs are lost unless they were previously shipped to a centralized logging service, and AWS Support cannot recover terminated instance data. AWS Trusted Advisor provides optimization recommendations and does not store or retrieve access logs.