A company's content management system (CMS) service runs on an laaS cluster on a public cloud. The CMS service is frequently targeted by a malicious threat actor using DDoS. Which of the following should a cloud engineer monitor to identify attacks?

A Distributed Denial of Service (DDoS) attack is fundamentally a network-based attack designed to overwhelm a target with a massive volume of traffic from multiple sources. Network flow logs capture metadata about all IP traffic traversing a network interface, including source/destination IP addresses, ports, protocols, and the volume of packets/bytes. By monitoring and analyzing these logs, a cloud engineer can identify the characteristic signatures of a DDoS attack, such as an abnormally high volume of traffic from a large number of disparate IP addresses targeting the CMS service. This provides the necessary network-level visibility to detect the attack in its early stages.

B. Endpoint detection and response logs: EDR focuses on malicious activity on an endpoint (e.g., malware, unauthorized processes), not on analyzing incoming network traffic volume from distributed sources.
C. Cloud provider event logs: These logs (e.g., AWS CloudTrail, Azure Activity Log) track management plane API calls and user activity, not the data plane network traffic that constitutes a DDoS attack.
D. Instance syslog: This log contains operating system and application-level events from a single instance. It lacks the network-wide perspective needed to identify a distributed attack pattern.

1. Amazon Web Services (AWS) Documentation. VPC Flow Logs. Amazon states that a key use case for VPC Flow Logs is "Monitoring the traffic that is reaching your instance... For example, you can use flow logs to help you diagnose overly restrictive security group rules." This same data is used to identify anomalous traffic patterns indicative of a DDoS attack. Retrieved from: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html (See section: "Flow log basics").

2. Microsoft Azure Documentation. Azure DDoS Protection overview. Microsoft explains that its protection service works by "monitoring actual traffic utilization and constantly comparing it against the thresholds... When the traffic threshold is exceeded, DDoS mitigation is initiated automatically." This monitoring is based on network flow telemetry, the same data captured in flow logs. Retrieved from: https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview (See section: "How DDoS Protection works").

3. Google Cloud Documentation. VPC Flow Logs overview. Google lists "Network monitoring" and "Network forensics" as primary use cases. For forensics, it states, "If an incident occurs, VPC Flow Logs can be used to determine... the traffic flow." This is essential for analyzing a DDoS incident. Retrieved from: https://cloud.google.com/vpc/docs/flow-logs (See section: "Use cases").

4. Carnegie Mellon University, Software Engineering Institute. Situational Awareness for Network Monitoring. In CERT/CC's guide to network monitoring, it emphasizes the importance of flow data (like NetFlow, the precursor to cloud flow logs) for "detecting and analyzing security events, such as denial-of-service (DoS) attacks." Retrieved from: https://resources.sei.cmu.edu/assetfiles/technicalnote/200400400114111.pdf (See Page 11, Section 3.2.2).