ANS-C01 · Question #57
A company has deployed an application in a VPC that uses a NAT gateway for outbound traffic to the internet. A network engineer notices a large quantity of suspicious network traffic that is…
The correct answer is C. Use VPC flow logs. Publish the flow logs to a log group in Amazon CloudWatch Logs. Use. To identify AWS resources generating suspicious outbound internet traffic through a NAT gateway with minimal cost and overhead, VPC flow logs should be published to CloudWatch Logs and analyzed using CloudWatch Logs Insights.
Question
A company has deployed an application in a VPC that uses a NAT gateway for outbound traffic to the internet. A network engineer notices a large quantity of suspicious network traffic that is traveling from the VPC over the internet to IP addresses that are included on a deny list. The network engineer must implement a solution to determine which AWS resources are generating the suspicious traffic. The solution must minimize cost and administrative overhead. Which solution will meet these requirements?
Options
- ALaunch an Amazon EC2 instance in the VPC. Use Traffic Mirroring by specifying the NAT
- BUse VPC flow logs. Launch a security information and event management (SIEM) solution in the
- CUse VPC flow logs. Publish the flow logs to a log group in Amazon CloudWatch Logs. Use
- DConfigure the VPC to stream the network traffic directly to an Amazon Kinesis data stream. Send
How the community answered
(27 responses)- A4% (1)
- B22% (6)
- C63% (17)
- D11% (3)
Why each option
To identify AWS resources generating suspicious outbound internet traffic through a NAT gateway with minimal cost and overhead, VPC flow logs should be published to CloudWatch Logs and analyzed using CloudWatch Logs Insights.
Traffic Mirroring provides deep packet inspection but requires additional EC2 instances for targets, significantly increasing cost and administrative overhead, and is not the most efficient way to identify the source of traffic passing through a NAT gateway.
While VPC flow logs are correct, launching a full Security Information and Event Management (SIEM) solution introduces substantial cost and administrative overhead, violating the requirement to minimize these factors.
VPC flow logs capture IP traffic details, including NAT gateway traffic, and publishing them to CloudWatch Logs allows for cost-effective storage and analysis using CloudWatch Logs Insights, which is a serverless query service, minimizing administrative overhead.
Streaming network traffic to an Amazon Kinesis data stream is for real-time processing but requires additional downstream processing and components, incurring more cost and administrative overhead than direct log analysis in CloudWatch Logs Insights.
Concept tested: VPC Flow Logs and CloudWatch Logs Insights for Network Troubleshooting
Source: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html
Topics
Community Discussion
No community discussion yet for this question.