ANS-C01 Question 331
Select 4Your organization hosts a multi-account AWS environment with multiple VPCs connected via AWS Transit Gateway. You have been tasked with monitoring network traffic flow across these accounts and ensuring compliance with organizational policies. Which AWS services and features can you use to achieve comprehensive visibility and compliance in this scenario?
- A
Amazon VPC Flow Logs
- B
AWS CloudTrail
- C
AWS Transit Gateway Network Manager
- D
Amazon CloudWatch Logs Insights
- E
AWS Direct Connect Gateway
Show answer and explanation
Correct answers: A, B, C, D
Explanation
To achieve comprehensive visibility and compliance in a multi-account AWS environment with a Transit Gateway, you need tools that provide both network traffic monitoring and activity auditing. Amazon VPC Flow Logs capture detailed traffic data, AWS CloudTrail monitors API and resource activity for compliance, and AWS Transit Gateway Network Manager provides centralized management of your Transit Gateway. Finally, Amazon CloudWatch Logs Insights can be used to analyze log data and identify issues. AWS Direct Connect Gateway, while useful for connecting on-premises environments, does not aid in monitoring or ensuring compliance.
- A. Correct.
Amazon VPC Flow Logs enables you to capture detailed information about the IP traffic going to and from network interfaces in your VPC, providing insight into network traffic patterns and potential compliance issues.
- B. Correct.
AWS CloudTrail records API activity and resource changes across AWS accounts, giving visibility into actions taken in your environment, which is essential for compliance auditing.
- C. Correct.
AWS Transit Gateway Network Manager helps monitor and manage your Transit Gateway network across multiple accounts and Regions, providing centralized visibility for your network architecture.
- D. Correct.
Amazon CloudWatch Logs Insights allows you to analyze and query log data, including VPC Flow Logs, enabling you to identify patterns, anomalies, or compliance issues in network traffic.
- E. Incorrect.
AWS Direct Connect Gateway is used to connect multiple VPCs to on-premises data centers, but it does not provide monitoring or visibility into network traffic or compliance.