ANS-C01 Question 122
Select 3Your company operates a highly secure e-commerce platform hosted on AWS. The platform uses an Amazon VPC with multiple subnets across two Availability Zones. Recently, a spike in failed payment transactions was reported, and you need to analyze whether these failures are caused by network-level issues or application-level issues. The solution must allow you to investigate both real-time traffic patterns and historical traffic data. Which combination of features should you use to achieve this?
- A
Enable VPC Flow Logs on the subnets to capture traffic metadata.
- B
Use Amazon CloudWatch Logs to view and analyze VPC Flow Log data.
- C
Set up Traffic Mirroring on the EC2 instances hosting the payment service.
- D
Enable AWS WAF logging to capture rejected web requests.
- E
Use AWS Config to track changes to VPC security group rules.
Show answer and explanation
Correct answers: A, B, C
Explanation
To diagnose network-level and application-level issues effectively, you need both historical traffic data and real-time packet analysis. VPC Flow Logs provide network metadata for historical analysis, while Traffic Mirroring allows you to analyze live traffic in real time. Using Amazon CloudWatch Logs to process and visualize the Flow Logs ensures the solution is comprehensive and actionable. AWS WAF and Config are not relevant to this specific use case.
- A. Correct.
VPC Flow Logs capture metadata about the IP traffic going to and from network interfaces in your VPC. This helps you analyze historical traffic patterns and troubleshoot past issues.
- B. Correct.
Amazon CloudWatch Logs is a native AWS tool that can be used to store and analyze VPC Flow Logs, enabling you to understand historical traffic data in more detail.
- C. Correct.
Traffic Mirroring allows you to capture and analyze real-time network packets, which can be critical for troubleshooting ongoing issues like failed payment transactions.
- D. Incorrect.
AWS WAF logging captures web request data, but it is focused on application-layer traffic (HTTP/S) and does not provide visibility into general network traffic or metadata.
- E. Incorrect.
AWS Config tracks changes to security group rules but does not provide traffic-level visibility. While useful for compliance, it is not relevant to analyzing traffic patterns.