ANS-C01 · Question #288
A company has a transit gateway in a single AWS account. The company sends flow logs for the transit gateway to an Amazon CloudWatch Logs log group. The company created an AWS Lambda function to…
The correct answer is B. Configure the existing Lambda function to add the source IP addresses of the dropped traffic to. Source IP Addresses in Dropped Traffic: When traffic is dropped by the transit gateway, the source IP addresses are the origin of the traffic causing the issue. To block this traffic from entering the VPC, an inbound rule must be added to the network ACL for the transit gateway…
Question
A company has a transit gateway in a single AWS account. The company sends flow logs for the transit gateway to an Amazon CloudWatch Logs log group. The company created an AWS Lambda function to analyze the logs. The Lambda function sends a notification to an Amazon Simple Notification Service (Amazon SNS) topic when a VPC generates traffic that is dropped by the transit gateway. Each notification contains the account ID. VPC ID, and total amount of dropped packets. The company wants to subscribe a new Lambda function to the SNS topic. The new Lambda function must automatically prevent the traffic that is identified in each notification from leaving a VPC by applying a network ACL to the transit gateway attachment subnets in the VPC that generates the traffic. Which solution will meet these requirements?
Options
- AConfigure the existing Lambda function to add the destination IP addresses of the dropped traffic
- BConfigure the existing Lambda function to add the source IP addresses of the dropped traffic to
- CConfigure the existing Lambda function to add the source IP addresses of the dropped traffic to
- DConfigure the existing Lambda function to add the destination IP addresses of the dropped traffic
How the community answered
(36 responses)- A8% (3)
- B72% (26)
- C14% (5)
- D6% (2)
Explanation
Source IP Addresses in Dropped Traffic: When traffic is dropped by the transit gateway, the source IP addresses are the origin of the traffic causing the issue. To block this traffic from entering the VPC, an inbound rule must be added to the network ACL for the transit gateway attachment subnets. Inbound Rule on Network ACL: Network ACLs (NACLs) are stateless and require explicit rules to allow or deny traffic. Adding an inbound rule to deny traffic from the source IP addresses effectively prevents the unwanted traffic from entering the VPC. Notification Details: The existing Lambda function should include the source IP addresses in the SNS notification so that the new Lambda function can use this information to automatically update the NACL.
Community Discussion
No community discussion yet for this question.