SCS-C02 Question 220
Select 2An organization is investigating a potential data exfiltration incident in their AWS environment. They want to identify what traffic left their VPC and determine which specific EC2 instance initiated the traffic. Which AWS security telemetry sources should they utilize to gather this information?
- A
VPC Flow Logs
- B
AWS CloudTrail data events for the S3 service
- C
Traffic Mirroring
- D
AWS Config
- E
Amazon GuardDuty findings
Show answer and explanation
Correct answers: A, C
Explanation
To investigate data exfiltration, VPC Flow Logs help identify traffic patterns and the source/destination of network communications, while Traffic Mirroring provides packet-level visibility, allowing for detailed inspection of the traffic. These two telemetry sources are complementary and directly relevant for identifying and analyzing unauthorized data leaving the VPC. Other options, such as AWS Config and GuardDuty, provide valuable security insights but do not offer the required level of network traffic analysis.
- A. Correct.
VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in your VPC. This can help identify traffic leaving the VPC and provide details on source and destination, which are critical for investigating data exfiltration.
- B. Incorrect.
AWS CloudTrail data events for the S3 service track API activity, such as GetObject or PutObject events, but they do not provide visibility into network traffic or the source instance initiating external network communications.
- C. Correct.
Traffic Mirroring allows you to capture actual packet-level traffic from an EC2 instance’s network interface. This provides deep visibility into the content of the traffic, enabling detailed forensic analysis for data exfiltration investigations.
- D. Incorrect.
AWS Config tracks configuration changes and resource compliance in AWS, but it does not provide network traffic telemetry or information about data leaving the VPC.
- E. Incorrect.
Amazon GuardDuty findings provide insights into potential threats and anomalies, but they rely on aggregated data sources and cannot directly identify specific traffic leaving the VPC or the originating instance.