SAP-C02 Question 39
Single answerA company is running multiple applications in an Amazon VPC and needs to monitor network traffic for security and compliance purposes. The security team wants to analyze traffic patterns, detect potential threats, and store the logs for future auditing. What is the MOST appropriate solution to achieve this?
- A
Enable VPC Flow Logs and send the logs to Amazon S3 for analysis and storage.
- B
Deploy an AWS Network Firewall in the VPC and configure it to log network traffic to Amazon CloudWatch Logs.
- C
Use AWS CloudTrail to monitor and log network traffic in the VPC.
- D
Configure an Amazon EC2 instance as a proxy server to capture and log network traffic.
Show answer and explanation
Correct answer: A
Explanation
The most appropriate solution for monitoring network traffic in a VPC is to enable VPC Flow Logs. VPC Flow Logs provide detailed information about IP traffic and can be sent to Amazon S3 for storage and analysis. This approach is scalable, cost-effective, and designed specifically for this purpose. Other options, like AWS Network Firewall or CloudTrail, either do not fully meet the requirement or are intended for different use cases.
- A. Correct.
VPC Flow Logs allow you to capture information about the IP traffic going to and from network interfaces in your VPC. Sending the logs to Amazon S3 enables long-term storage and further analysis.
- B. Incorrect.
AWS Network Firewall is a managed firewall service primarily used for filtering network traffic and protecting workloads. While it can log some traffic, it is not designed as a comprehensive network traffic monitoring solution.
- C. Incorrect.
AWS CloudTrail is used to log API calls and actions taken on AWS resources. It does not monitor or log network traffic within a VPC.
- D. Incorrect.
Configuring an EC2 instance as a proxy server to capture traffic might work in some scenarios, but it is not scalable, efficient, or a best practice for monitoring all traffic in a VPC.