SAP-C02 Question 36
Select 2You are a Solutions Architect for a media company, and your security team wants to monitor network traffic to and from your web servers hosted in an Amazon VPC. They want the ability to analyze patterns, detect anomalies, and store the data for future audits. Which of the following options can you implement to meet these requirements?
- A
Enable VPC Flow Logs on the VPC and send the logs to Amazon S3 for storage and analysis.
- B
Deploy an AWS Network Firewall to inspect and log all network traffic.
- C
Use AWS CloudTrail to monitor network traffic and log requests to your web servers.
- D
Enable Traffic Mirroring on the web server instances and send the mirrored traffic to an Amazon EC2 instance for analysis.
- E
Use Amazon Inspector to monitor and log all incoming and outgoing network traffic.
Show answer and explanation
Correct answers: A, D
Explanation
To monitor network traffic and meet the requirements, you can use a combination of VPC Flow Logs for metadata analysis and Traffic Mirroring for deeper packet-level inspection. VPC Flow Logs allow you to log and store metadata for long-term analysis, while Traffic Mirroring provides the capability to analyze real-time traffic in depth. Other options like AWS Network Firewall or Amazon Inspector do not directly address traffic monitoring needs, and AWS CloudTrail is focused on API activity rather than network traffic.
- A. Correct.
VPC Flow Logs capture network traffic metadata such as source IPs, destination IPs, and ports. Sending the logs to Amazon S3 allows storing and analyzing the data, which meets the requirements for monitoring patterns and future audits.
- B. Incorrect.
AWS Network Firewall is primarily used for filtering and protecting traffic, not specifically for monitoring or logging network traffic for analysis. While it can log traffic, it is not the most cost-effective or direct solution for this use case.
- C. Incorrect.
AWS CloudTrail is used to log API calls and management events, not for monitoring network traffic. It does not meet the requirements for analyzing network traffic patterns or storing data for audits.
- D. Correct.
Traffic Mirroring allows you to capture and forward actual network traffic to an analysis tool or EC2 instance. This can provide deep, packet-level analysis of traffic, meeting the requirement for detecting anomalies and patterns.
- E. Incorrect.
Amazon Inspector is a vulnerability assessment tool and does not monitor or log network traffic. It is not relevant to this use case.