SCS-C02 Question 306
Single answerA company is running critical workloads on Amazon EC2 instances within a VPC. The company requires that all traffic to and from the instances is inspected for potential threats and unauthorized activity. Additionally, they want to ensure that their security team can implement rules to block malicious traffic dynamically. Which solution should the company use to meet this requirement?
- A
Deploy an AWS WAF (Web Application Firewall) to the VPC to inspect and block malicious traffic.
- B
Use AWS Network Firewall to inspect network traffic and apply stateful rules for threat detection and blocking.
- C
Enable VPC Traffic Mirroring and analyze the mirrored traffic using a third-party security appliance hosted on an EC2 instance.
- D
Use AWS Shield Advanced to monitor traffic and automatically block threats at the network layer.
Show answer and explanation
Correct answer: B
Explanation
The company requires a solution for inspecting and blocking unauthorized traffic dynamically within their VPC. AWS Network Firewall is the best choice as it provides advanced network traffic filtering capabilities, including stateful inspection and custom rule implementation. Other options like AWS WAF, Traffic Mirroring, or Shield Advanced either do not meet the requirements for inspecting all network traffic or lack the ability to block traffic dynamically.
- A. Incorrect.
AWS WAF is designed to protect web applications and APIs from common exploits such as SQL injection or cross-site scripting (XSS). However, it does not provide the ability to inspect and block all network traffic within a VPC, which is required in this scenario.
- B. Correct.
AWS Network Firewall is a fully managed service that provides network traffic inspection, threat detection, and rule enforcement within a VPC. It supports stateful rule groups and deep packet inspection, making it the best choice for this use case.
- C. Incorrect.
VPC Traffic Mirroring allows you to monitor network traffic by mirroring it to a monitoring appliance or tool. However, this solution is only for traffic analysis and does not provide built-in capability to dynamically block malicious activity.
- D. Incorrect.
AWS Shield Advanced is a managed DDoS protection service. While it provides protection against distributed denial-of-service attacks, it does not offer functionality for inspecting and blocking general unauthorized or malicious traffic within a VPC.