SAP-C02 · Question #866
A company's application runs on an Amazon EC2 instance in a VPC. Only specific IP addresses listed in the application's security group can access the application. The company wants to automatically…
The correct answer is B. Configure VPC Flow Logs for the VPC. Publish the flow logs to Amazon S3. Create an Amazon. VPC Flow Logs capture all IP traffic to and from the EC2 instance, which allows identification of inactive IP addresses. Publishing the flow logs to S3 and querying them with Amazon Athena enables efficient analysis over a 90-day period. An AWS Lambda function can automate the…
Question
A company's application runs on an Amazon EC2 instance in a VPC. Only specific IP addresses listed in the application's security group can access the application. The company wants to automatically remove inactive IP addresses that have not accessed the EC2 instance in the last 90 days. Which solution meets these requirements?
Options
- AConfigure VPC Flow Logs for the VPC. Publish the flow logs to Amazon DynamoDB. Create an
- BConfigure VPC Flow Logs for the VPC. Publish the flow logs to Amazon S3. Create an Amazon
- CEnable AWS CloudTrail logs for the company's AWS account. Create an Amazon Athena table to
- DEnable AWS CloudTrail logs for the company's AWS account. Create an AWS Lambda function
How the community answered
(28 responses)- A4% (1)
- B82% (23)
- C4% (1)
- D11% (3)
Explanation
VPC Flow Logs capture all IP traffic to and from the EC2 instance, which allows identification of inactive IP addresses. Publishing the flow logs to S3 and querying them with Amazon Athena enables efficient analysis over a 90-day period. An AWS Lambda function can automate the removal of security group rules for IPs not seen in the logs, and EventBridge can trigger the Lambda function daily, fully automating the process with minimal operational overhead.
Community Discussion
No community discussion yet for this question.