A company runs a fleet of Amazon EC2 instances in a VPC. The company's employees remotely access the EC2 instances by using the Remote Desktop Protocol (RDP). The company wants to collect metrics…

Question

Options

• ACreate an Amazon EventBridge rule that reacts to EC2 Instance State-change Notification
• BCreate an Amazon CloudWatch Logs log group. Specify the log group as a target for the
• CCreate a flow log in VPC Flow Logs.
• DCreate an Amazon CloudWatch Logs log group. Specify the log group as a destination for the
• ECreate a log group metric filter.
• FCreate a log group subscription filter. Use EventBridge as the destination.

• A
  3% (1)
• B
  6% (2)
• C
  75% (27)
• F
  17% (6)

Explanation

VPC Flow Logs can capture IP traffic data, which includes the details of connections made to and from the EC2 instances. Since employees use RDP (Remote Desktop Protocol) to access the instances, the VPC flow logs will capture this traffic data (typically on port 3389 for RDP). Flow logs need a destination to store their output, and CloudWatch Logs is a standard and efficient storage option. By specifying a CloudWatch Logs log group as the destination for flow logs, you can store the captured network traffic data that includes the RDP session details. A CloudWatch Logs metric filter can be used to search for specific patterns in the log data. In this case, you can create a filter to look for RDP connection attempts (based on the IP protocol and port 3389), which will give you a count of RDP sessions initiated every day.

No community discussion yet for this question.