1Z0-1072-25 Question 178
Single answerYour organization needs to capture and analyze only inbound HTTP traffic to a private subnet without impacting the production environment. You have configured a virtual test access point (VTAP) to mirror traffic. Which approach will achieve this requirement using capture filters in Oracle Cloud Infrastructure?
- A
Create a capture filter rule specifying TCP port 80 on inbound traffic and associate it with the VTAP resource.
- B
Set up a route table entry pointing inbound traffic on port 80 to a load balancer as the capture filter target.
- C
Configure a Security List rule that allows inbound port 80 and assume all inbound traffic will be captured automatically.
- D
Attach the same capture filter to all subnets in the VCN without specifying ports to capture the relevant traffic.
Show answer and explanation
Correct answer: A
Explanation
Using Virtual Test Access Points (VTAPs) in Oracle Cloud Infrastructure allows you to non-intrusively mirror specific traffic for analysis. To narrow the mirrored traffic to just HTTP over port 80, create a capture filter that specifies protocol TCP, port 80, and the inbound direction. Then associate this filter with the VTAP. This approach follows best practices documented in Oracle� VTAP documentation (for example, the 'Implementing VTAP and Capture Filters' section) to minimize unnecessary network overhead and focus on the traffic of interest.
- A. Correct.
Correct. To limit the captured traffic to inbound HTTP, you must create a capture filter with a rule for TCP port 80 and apply it to the VTAP. This ensures only matching traffic is mirrored for analysis.
- B. Incorrect.
Incorrect. A route table entry redirects traffic at the routing level but does not function as a capture filter. Route table changes won't selectively filter mirrored traffic for VTAP.
- C. Incorrect.
Incorrect. Security List rules control which traffic is allowed or blocked, not which traffic is mirrored. Simply allowing inbound port 80 will not automatically mirror only port 80 traffic for the VTAP.
- D. Incorrect.
Incorrect. Attaching the same filter to every subnet without filtering ports captures all traffic, which does not meet the goal of selectively capturing only HTTP inbound traffic.