SCS-C02 Question 223
Select 2Your company has implemented an EC2-based application in a VPC that processes sensitive customer data. To enhance security monitoring, you need to capture network traffic for deep packet inspection and also log information about IP traffic flowing to and from your EC2 instances. Which combination of AWS services should you use to achieve this?
- A
Traffic Mirroring
- B
VPC Flow Logs
- C
AWS Shield Advanced
- D
Amazon GuardDuty
- E
AWS CloudTrail
Show answer and explanation
Correct answers: A, B
Explanation
To monitor network activity effectively in this scenario, you need to use Traffic Mirroring to capture and inspect actual packet-level traffic and VPC Flow Logs to log metadata about IP traffic. These services complement each other and provide comprehensive visibility into network activity for security monitoring and analysis. Other options, such as GuardDuty and CloudTrail, provide different types of security-related insights but are not suitable for capturing or logging network traffic.
- A. Correct.
Traffic Mirroring allows you to capture and analyze network traffic at the packet level, making it suitable for deep packet inspection and troubleshooting.
- B. Correct.
VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in your VPC, helping you monitor traffic patterns and identify potential security issues.
- C. Incorrect.
AWS Shield Advanced is a managed service that provides DDoS protection but does not capture network traffic or log IP traffic.
- D. Incorrect.
Amazon GuardDuty is a threat detection service that analyzes AWS logs to identify threats, but it does not directly capture network traffic or provide flow logs.
- E. Incorrect.
AWS CloudTrail records API calls and user activity in your AWS environment, but it does not capture or log network traffic.