ANS-C01 Question 102
Select 3Your organization manages a hybrid network that connects an on-premises data center to AWS using a Site-to-Site VPN. The security team requires visibility into network traffic for troubleshooting and compliance purposes. Which combination of solutions should you implement to define logging and monitoring requirements for this hybrid environment?
- A
Enable VPC Flow Logs on the AWS VPC to capture IP traffic metadata.
- B
Use AWS CloudTrail to monitor and log API calls for Site-to-Site VPN configuration changes.
- C
Deploy an AWS Network Firewall to log all traffic between the on-premises network and the AWS environment.
- D
Set up CloudWatch Alarms to monitor VPN tunnel status and notify the operations team of any tunnel failures.
- E
Use Amazon Macie to monitor and log sensitive data traffic across the hybrid network.
Show answer and explanation
Correct answers: A, B, D
Explanation
To define logging and monitoring requirements for a hybrid network, it is crucial to capture both network traffic metadata and configuration changes, and to set up proactive monitoring. VPC Flow Logs provide traffic metadata, CloudTrail tracks configuration changes, and CloudWatch Alarms help monitor VPN tunnel health. These solutions together address the core requirements of the scenario.
- A. Correct.
Enabling VPC Flow Logs provides detailed network traffic metadata, helping to monitor traffic in and out of the VPC. This is critical for hybrid network monitoring and logging.
- B. Correct.
CloudTrail is essential for tracking configuration changes to the Site-to-Site VPN, ensuring compliance and aiding in debugging issues.
- C. Incorrect.
AWS Network Firewall is primarily designed for threat detection and prevention, not necessarily for logging the traffic between on-premises and AWS. While it could be used for certain scenarios, it is not the most appropriate solution here.
- D. Correct.
CloudWatch Alarms are effective for monitoring the VPN tunnel's health and notifying the team if there are any connectivity issues. This aligns with the monitoring requirements.
- E. Incorrect.
Amazon Macie is a service for monitoring sensitive data and does not provide network traffic logging or monitoring capabilities. Thus, it is not relevant to this scenario.