SAP-C02 Question 38
Select 2An organization is running a mission-critical application on AWS, and they want to monitor network traffic between instances within a VPC to detect anomalies and troubleshoot issues. They require a cost-effective solution that does not interfere with the application’s performance. Which combination of AWS services and features should be used to meet this requirement?
- A
Enable VPC Flow Logs to capture network traffic metadata for the VPC.
- B
Use AWS Network Firewall to create rules and log all traffic passing through the VPC.
- C
Leverage Amazon CloudWatch Logs to store and analyze VPC Flow Logs data.
- D
Deploy an EC2 instance with a packet capture tool to inspect all traffic in real time.
- E
Set up AWS Traffic Mirroring to replicate network traffic to a monitoring appliance.
Show answer and explanation
Correct answers: A, C
Explanation
To monitor network traffic effectively and cost-efficiently without impacting application performance, VPC Flow Logs should be enabled to capture traffic metadata, and Amazon CloudWatch Logs can be used to store and analyze this data. This combination meets the organization's requirements without introducing unnecessary complexity or costs.
- A. Correct.
VPC Flow Logs provide a cost-effective way to capture metadata about network traffic within a VPC without impacting application performance. However, they do not capture the full packet payload.
- B. Incorrect.
AWS Network Firewall is primarily used for security and rule enforcement, not for monitoring network traffic within a VPC. It could also be cost-prohibitive for this use case.
- C. Correct.
Amazon CloudWatch Logs is a suitable service for storing and analyzing the metadata captured by VPC Flow Logs. It allows you to filter and query traffic patterns easily.
- D. Incorrect.
Deploying an EC2 instance with a packet capture tool is not cost-effective and can introduce performance overhead, especially in a high-traffic environment.
- E. Incorrect.
AWS Traffic Mirroring provides packet-level network traffic replication, but it can be more expensive and is typically used for advanced use cases requiring full packet inspection.