SAP-C02 Question 40
Select 3An organization runs a critical application on AWS that handles sensitive financial data. The organization is required to monitor all network traffic to and from the application to identify potential malicious activity and ensure compliance with regulatory requirements. Which combination of AWS services and features would best meet this requirement?
- A
Enable Amazon VPC Flow Logs to capture detailed metadata about network traffic in the VPC.
- B
Use Amazon CloudWatch Logs to store and analyze the VPC Flow Log data.
- C
Deploy AWS Network Firewall to inspect and filter network traffic in real time.
- D
Configure Amazon GuardDuty to analyze and detect suspicious activity across AWS accounts and resources.
- E
Set up AWS WAF to block malicious IP addresses and monitor application layer traffic.
Show answer and explanation
Correct answers: A, B, D
Explanation
To monitor all network traffic effectively, enabling VPC Flow Logs is crucial as it provides metadata about incoming and outgoing traffic. Storing and analyzing this data using Amazon CloudWatch Logs allows for detailed monitoring and compliance reporting. Additionally, Amazon GuardDuty provides intelligent threat detection by analyzing VPC Flow Log data for anomalous patterns and suspicious behavior. While AWS Network Firewall and AWS WAF are valuable for traffic filtering and application layer security, they are not the primary tools for network traffic monitoring and analysis.
- A. Correct.
VPC Flow Logs capture metadata about network traffic in a VPC, which is essential for monitoring and investigating traffic patterns. However, they do not provide deep packet inspection or filtering capabilities.
- B. Correct.
Amazon CloudWatch Logs can be used to store and analyze VPC Flow Log data, enabling you to monitor patterns and detect unusual activity. It complements VPC Flow Logs for traffic monitoring.
- C. Incorrect.
AWS Network Firewall is primarily used for deep packet inspection and filtering of network traffic. While it is useful for securing traffic, it is not directly needed for monitoring traffic metadata and detecting malicious activity.
- D. Correct.
Amazon GuardDuty analyzes AWS CloudTrail, VPC Flow Logs, and DNS logs to detect anomalous or suspicious activities. It is well-suited for identifying potential security threats.
- E. Incorrect.
AWS WAF is designed to monitor and block application layer traffic, such as SQL injection or cross-site scripting. While useful for web application security, it does not fulfill the requirement of monitoring all network traffic across a VPC.