ANS-C01 Question 465
Select 3Your organization recently deployed an application in a VPC that handles sensitive data. To ensure compliance with internal security policies, you need to monitor and log network activity within the VPC and analyze the traffic for potential anomalies. Which combination of AWS services should you use to meet this requirement?
- A
VPC Flow Logs
- B
AWS CloudTrail
- C
VPC Traffic Mirroring
- D
Amazon CloudWatch
- E
AWS Transit Gateway Network Manager
Show answer and explanation
Correct answers: A, C, D
Explanation
To monitor and analyze network traffic within a VPC for compliance and anomaly detection, you need a combination of tools. VPC Flow Logs capture network flow metadata, while VPC Traffic Mirroring captures actual packet data for deeper analysis. Amazon CloudWatch helps visualize and monitor these logs and metrics. AWS CloudTrail and Transit Gateway Network Manager, while useful in other contexts, do not directly address these specific requirements.
- A. Correct.
VPC Flow Logs capture detailed information about the IP traffic going to and from network interfaces in your VPC, making it a critical tool for monitoring and analyzing network activity.
- B. Incorrect.
AWS CloudTrail primarily logs API activity and user actions across your AWS account. While useful for auditing, it does not capture network-level traffic information.
- C. Correct.
VPC Traffic Mirroring allows you to capture and analyze actual network packet data from your instances, which is useful for deep network traffic analysis and identifying anomalies.
- D. Correct.
Amazon CloudWatch provides monitoring and alerting capabilities, enabling you to visualize and analyze metrics, including those derived from VPC Flow Logs, to detect anomalies.
- E. Incorrect.
AWS Transit Gateway Network Manager is designed to provide global network visibility and manage Transit Gateway attachments across multiple regions, but it is not directly relevant for monitoring VPC-level network traffic.