After migrating to AWS, a company is replacing software load balancers running on EC2 instances with AWS Elastic Load Balancers. The security engineer must ensure that all load balancer logs are centralized and searchable for audits and that metrics are available to show which TLS ciphers are in use. Which solution meets these requirements?

The correct solution leverages S3 for cost-effective log storage and Athena for powerful, ad-hoc querying of those logs. Elastic Load Balancers (ELBs) natively support logging to S3. Athena can then be used to analyze the S3 logs, including extracting specific TLS cipher information, and these derived metrics can be published to CloudWatch for monitoring. Incorrect options: Sending ELB logs directly to CloudWatch Logs is not a native ELB feature; ELBs log to S3. While CloudWatch Logs can store logs, it's not the primary or most efficient method for ELB access logs. While S3 is correct for log storage and Athena for searching, creating CloudWatch metric filters directly on S3 log files is not how CloudWatch metric filters typically operate. Metric filters usually apply to CloudWatch Logs streams. The fourth option incorrectly suggests sending ELB logs to CloudWatch Logs and then using Athena to query them, which is not a direct or standard integration. Athena queries S3, not CloudWatch Logs directly for this use case.