During a suspected scraping attack, the team wants a real-time ranking of the client IP addresses generating the most 4xx responses on an ALB. Which feature provides that ranking?
Show answer and explanation
Answer: A
Contributor Insights evaluates log events against a rule that names a key field, such as client_ip, and reports the top contributors over a rolling time window. Pointing that rule at the ALB access log group and filtering on 4xx status codes surfaces the noisiest clients within minutes. The ranked list is exactly what is needed to identify and block a scraper.
Why the other options are wrong
- B. The ServiceLens map shows how services call each other and where traces slow down. It does not rank values found in log records.
- C. A canary runs a scripted user journey from multiple locations to test availability. It does not analyze access logs.
- D. Embedded Metric Format lets an application emit metrics through log lines. It is an ingestion format, not an analyzer.
Exam tip. Top-N values from logs means Contributor Insights.