ANS-C01 Question 119
Select 2An organization has deployed a multi-tier application in AWS. The application consists of a public-facing web tier in an Auto Scaling group, a private application tier, and a database tier in an Amazon RDS instance. The organization wants to monitor the network traffic to identify potential security threats and troubleshoot connectivity issues between the tiers. Which combination of solutions will help achieve this requirement?
- A
Enable VPC Flow Logs for the subnets where the application is deployed.
- B
Configure Traffic Mirroring on the network interfaces of the application tier's instances.
- C
Enable AWS Config to track changes to the security groups in the VPC.
- D
Use AWS CloudTrail to log API calls made to modify network ACLs.
- E
Deploy a third-party network monitoring appliance in the VPC.
Show answer and explanation
Correct answers: A, B
Explanation
To achieve visibility into network traffic for security and troubleshooting purposes, AWS-native services like VPC Flow Logs and Traffic Mirroring are the most efficient and scalable solutions. VPC Flow Logs provide visibility at the IP traffic flow level, while Traffic Mirroring allows for packet-level inspection. AWS Config and CloudTrail are useful for configuration tracking and auditing but do not provide real-time traffic visibility. Using third-party appliances is not necessary when native AWS solutions are available.
- A. Correct.
Enabling VPC Flow Logs provides visibility into the IP traffic going to and from network interfaces in your VPC, which can help in identifying security threats and troubleshooting connectivity issues.
- B. Correct.
Traffic Mirroring allows you to capture and inspect network traffic at the packet level from Elastic Network Interfaces, making it useful for deep packet inspection and advanced threat analysis.
- C. Incorrect.
While AWS Config can track changes to security group configurations, it does not provide traffic-level visibility or insights into network communication.
- D. Incorrect.
AWS CloudTrail tracks API calls, which can help identify who modified network ACLs, but it does not capture actual network traffic or provide insights into connectivity issues.
- E. Incorrect.
Using a third-party network monitoring appliance could be a solution, but it is not the most efficient or recommended method when AWS services like VPC Flow Logs and Traffic Mirroring can achieve the same goals with native integration.