ANS-C01 Question 121
Select 2An organization is running a multi-tier web application on AWS. They are experiencing intermittent connectivity issues between their application servers in a private subnet and a backend database in another private subnet within the same VPC. To troubleshoot this issue, they need detailed visibility into network traffic and packet-level information. Which combination of solutions would help them achieve this?
- A
Enable VPC Flow Logs on the VPC and analyze the logs in Amazon CloudWatch or S3
- B
Use Traffic Mirroring to capture packet-level data and analyze it with a network analysis tool
- C
Enable AWS Shield Advanced to protect against DDoS attacks and monitor traffic patterns
- D
Deploy AWS Network Firewall to log traffic and detect anomalies in the application
- E
Use Amazon GuardDuty to identify malicious traffic within the VPC
Show answer and explanation
Correct answers: A, B
Explanation
To effectively troubleshoot connectivity issues between the application servers and the backend database, the organization needs both high-level traffic visibility and detailed packet-level analysis. VPC Flow Logs provide information about accepted and rejected traffic, security group rules, and traffic patterns. Traffic Mirroring, on the other hand, enables capturing of packet-level data, which is essential for diagnosing complex network issues. Together, these solutions provide comprehensive visibility and troubleshooting capabilities for the described scenario.
- A. Correct.
Enabling VPC Flow Logs provides visibility into the IP traffic flowing to and from network interfaces in the VPC. While it does not capture packet-level information, it is useful for identifying connectivity issues, such as rejected traffic or overly restrictive security group rules.
- B. Correct.
Traffic Mirroring allows you to capture packet-level data from specific Elastic Network Interfaces (ENIs) and analyze it with third-party tools. This is essential for in-depth troubleshooting of network issues, making it a key solution in this scenario.
- C. Incorrect.
AWS Shield Advanced is primarily a DDoS protection service. While it provides insights into DDoS-related traffic, it is not designed for troubleshooting internal VPC connectivity issues.
- D. Incorrect.
AWS Network Firewall is used to protect your VPC by filtering traffic and detecting threats. While it can log traffic, it is not specifically designed for troubleshooting subtle connectivity issues between application layers.
- E. Incorrect.
Amazon GuardDuty provides threat detection and monitoring for malicious activity but does not offer packet-level visibility or detailed insights into connectivity issues.