SCS-C02 Question 222
Select 2Your organization is experiencing unusual traffic patterns in a specific Amazon VPC, and you suspect a potential security incident. You need to collect and analyze network traffic data to identify the root cause. Which of the following AWS services or features can be used to gather detailed security telemetry data for investigation purposes?
- A
Traffic Mirroring
- B
VPC Flow Logs
- C
AWS CloudTrail
- D
Amazon Macie
- E
AWS Config
- F
AWS Network Firewall
Show answer and explanation
Correct answers: A, B
Explanation
To investigate unusual traffic patterns and potential security incidents in an Amazon VPC, you need tools that provide detailed network traffic telemetry. Traffic Mirroring allows you to capture packet-level data for in-depth analysis, while VPC Flow Logs give you flow-level metadata about network traffic. Together, these tools provide comprehensive visibility into network behavior, helping to identify and address security issues effectively. Other services like AWS CloudTrail, Amazon Macie, AWS Config, and AWS Network Firewall serve different purposes and do not provide the same level of network traffic analysis.
- A. Correct.
Traffic Mirroring allows you to capture and inspect network traffic at the packet level for specific EC2 instances, making it ideal for detailed forensic analysis or real-time threat detection.
- B. Correct.
VPC Flow Logs provide metadata about network traffic going to and from network interfaces in your VPC, which is useful for identifying anomalous traffic patterns and troubleshooting connectivity issues.
- C. Incorrect.
AWS CloudTrail is primarily used for auditing API activity and user actions in your AWS environment but does not capture network traffic details.
- D. Incorrect.
Amazon Macie is a data security service designed to classify and protect sensitive data, not to analyze network traffic.
- E. Incorrect.
AWS Config tracks configuration changes in your AWS resources but is not designed to provide security telemetry for network traffic analysis.
- F. Incorrect.
AWS Network Firewall provides network protection and traffic filtering capabilities but does not directly collect or analyze network telemetry data.