ANS-C01 · Question #216
A company wants to use an AWS Network Firewall firewall to secure its workloads in the cloud through network traffic inspection. The company must record complete metadata information, such as…
The correct answer is C. Create a firewall policy to ensure that a stateful engine processes all the traffic. Configure. The company needs to configure AWS Network Firewall to record comprehensive network traffic metadata, all flows, and all DROP/ALERT actions, requiring a specific firewall policy and logging setup.
Question
A company wants to use an AWS Network Firewall firewall to secure its workloads in the cloud through network traffic inspection. The company must record complete metadata information, such as source/destination IP addresses and protocol type. The company must also record all network traffic flows and any DROP or ALERT actions that the firewall takes for traffic that the firewall processes. The Network Firewall endpoints are placed in the correct subnets, and the VPC route tables direct traffic to the Network Firewall endpoints on the path to and from the internet. How should a network engineer configure the firewall to meet these requirements?
Options
- ACreate a firewall policy to ensure that traffic is processed by stateless or stateful rules according
- BCreate a firewall policy to ensure that traffic is processed by stateless or stateful rules according
- CCreate a firewall policy to ensure that a stateful engine processes all the traffic. Configure
- DCreate a firewall policy to ensure that a stateful engine processes all the traffic. Configure VPC
How the community answered
(30 responses)- A7% (2)
- B3% (1)
- C77% (23)
- D13% (4)
Why each option
The company needs to configure AWS Network Firewall to record comprehensive network traffic metadata, all flows, and all DROP/ALERT actions, requiring a specific firewall policy and logging setup.
This option is incomplete and doesn't specify how to achieve comprehensive logging of *all* traffic flows and actions, particularly for the stateful engine.
This option, like A, is incomplete and doesn't specify how to achieve comprehensive logging for all requirements, including flow logs and specific actions. Using a `HomeNet` variable is for rule matching, not logging configuration itself.
To record complete metadata, all network traffic flows, and all DROP/ALERT actions, the Network Firewall must process traffic using its stateful engine, as stateless rules provide limited logging. Configuring logging for the stateful rule group to send alerts and flow logs to an Amazon S3 bucket (or CloudWatch Logs/Kinesis Firehose) ensures that all required information, including detailed flow records and action taken by stateful rules, is captured.
VPC Flow Logs capture general network traffic flow information but are separate from Network Firewall's specific logging capabilities for its rule processing and actions. Network Firewall logging provides more granular detail about rule hits and actions (DROP/ALERT) taken by the firewall itself, which is distinct from raw VPC flow logs.
Concept tested: AWS Network Firewall logging and stateful engine
Source: https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-logging.html
Community Discussion
No community discussion yet for this question.