ANS-C01 · Question #115
A company has been using an outdated application layer protocol for communication among applications. The company decides not to use this protocol anymore and must migrate all applications to…
The correct answer is C. Configure VPC flow logs to be delivered into an Amazon S3 bucket. Use Amazon Athena to query. Explanation Option C is correct because VPC Flow Logs capture actual network traffic metadata (including source/destination ports) flowing through the VPC, and Amazon Athena allows you to query this data using SQL to identify any connections still using the old protocol's port…
Question
A company has been using an outdated application layer protocol for communication among applications. The company decides not to use this protocol anymore and must migrate all applications to support a new protocol. The old protocol and the new protocol are TCP-based, but the protocols use different port numbers. After several months of work, the company has migrated dozens of applications that run on Amazon EC2 instances and in containers. The company believes that all the applications have been migrated, but the company wants to verify this belief. A network engineer needs to verify that no application is still using the old protocol. Which solution will meet these requirements without causing any downtime?
Options
- AUse Amazon Inspector and its Network Reachability rules package. Wait until the analysis has
- BEnable Amazon GuardDuty. Use the graphical visualizations to filter for traffic that uses the port
- CConfigure VPC flow logs to be delivered into an Amazon S3 bucket. Use Amazon Athena to query
- DInspect all security groups that are assigned to the EC2 instances that host the applications.
How the community answered
(21 responses)- A14% (3)
- B10% (2)
- C71% (15)
- D5% (1)
Explanation
Explanation
Option C is correct because VPC Flow Logs capture actual network traffic metadata (including source/destination ports) flowing through the VPC, and Amazon Athena allows you to query this data using SQL to identify any connections still using the old protocol's port number - all without interrupting production traffic or causing downtime.
Why the distractors are wrong:
- Option A (Amazon Inspector) analyzes potential network reachability and vulnerability exposure, not actual live traffic - it cannot confirm whether a specific port is actively being used by applications.
- Option B (Amazon GuardDuty) is a threat detection service focused on identifying malicious or unauthorized behavior; it doesn't provide a reliable mechanism to filter and audit all traffic by specific application port usage.
- Option D (Inspecting security groups) only tells you which ports are allowed, not which ports are actively being used - an old port may still be open in a security group even if no traffic flows through it, or vice versa.
Memory Tip: Think of it this way - "Flow Logs = Facts, Inspector = Findings, GuardDuty = Threats, Security Groups = Permissions." When you need to verify actual traffic behavior (not potential exposure or threats), VPC Flow Logs + Athena is your go-to combination for passive, non-disruptive traffic analysis.
Topics
Community Discussion
No community discussion yet for this question.