ANS-C01 Question 433
Select 3Your company has deployed a set of web applications in an Amazon VPC, and you are tasked with ensuring that the environment complies with strict security and compliance requirements, including the prevention of data exfiltration. Which combination of configurations should you implement to meet these requirements?
- A
Enable VPC Flow Logs to capture all traffic and send logs to Amazon CloudWatch for analysis.
- B
Configure an egress-only internet gateway for the web servers.
- C
Implement a Network ACL with rules allowing only specific IP ranges for outbound traffic.
- D
Set up AWS WAF with rules to block malicious traffic to web applications.
- E
Use AWS Config to record changes to network configurations and evaluate compliance.
Show answer and explanation
Correct answers: A, C, E
Explanation
To meet strict security and compliance needs, you should leverage tools like VPC Flow Logs to monitor traffic, Network ACLs to restrict unauthorized outbound traffic, and AWS Config to audit and enforce compliance. These configurations collectively address the requirements for monitoring, controlling, and maintaining compliance in the network environment.
- A. Correct.
Enabling VPC Flow Logs allows you to capture metadata of traffic through your VPC, which is crucial for auditing and monitoring traffic patterns to detect potential data exfiltration.
- B. Incorrect.
An egress-only internet gateway is used for IPv6 traffic and does not directly prevent data exfiltration for IPv4 traffic, which is used by most applications.
- C. Correct.
Using a Network ACL to restrict outbound traffic to specific IP ranges ensures that only approved destinations are reachable, reducing the risk of data exfiltration.
- D. Incorrect.
AWS WAF is effective for protecting web applications from malicious traffic but does not directly address the issue of data exfiltration.
- E. Correct.
AWS Config helps ensure compliance by recording network configuration changes and auditing them against compliance rules, which is essential for meeting regulatory requirements.