You, as a sysops administrator, configure a bunch of web ACLs in AWS WAF. In order to monitor whether the ACLs work as expected, you want to get detailed logs about traffic analyzed by the web ACLs. The logs should include information such as the details of the requests and the action if a request matches a rule. Which of the following sets of actions do you need to perform? (Select TWO.)

Answer options:

A.Create an Amazon Kinesis Data Stream for AWS WAF to forward logs in real-time.
B.Create an Amazon Kinesis Data Firehose using a name starting with the prefix "aws-waf-logs-".
C.Create a CloudWatch Log group named with the prefix "aws-waf-logs-".
D.In the AWS WAF console, select the ACLs, enable logging, and select the Kinesis Data Firehose as the destination.
E.In the AWS WAF console, select the ACLs and choose a CloudWatch Log group as the logging destination.

Correct Answers: B and D
Option A is incorrect because, according to https://docs.aws.amazon.com/waf/latest/developerguide/logging.html, Kinesis Data Stream cannot be used. And there is no need to stream logs in real-time.
Option B is CORRECT because an Amazon Kinesis Data Firehose is required to put the logs. The Firehose name should begin with "aws-waf-logs-".
Option C is incorrect because CloudWatch Log is not used for AWS WAF ACL logs.
Option D is CORRECT because you need to explicitly enable logging in WAF ACLs and choose the Kinesis Data Firehose to put the logs.
Option E is incorrect because a CloudWatch Log group cannot be selected as the logging destination of WAF ACLs.
Reference:
https://docs.aws.amazon.com/waf/latest/developerguide/logging.html