Examkin

Question

Difficulty: MediumSecurity Monitoring and Threat Detection

A financial services company hosts a critical transaction application on Amazon EC2 instances within a private subnet. The security team must implement a solution to monitor all inbound and outbound network traffic at the subnet level to detect network anomalies, such as active port scanning and unauthorized SSH connection attempts, without impacting application performance. Which solution meets these requirements?

  1. Enable VPC Flow Logs on the subnet to capture traffic data, and enable Amazon GuardDuty to analyze the flow logs and generate security findings.Answer
  2. B
    Configure stateful Network ACLs at the subnet level to log all rejected traffic, and use AWS Shield Standard to analyze the logs for network anomalies.
  3. C
    Deploy AWS WAF at the subnet level to inspect all inbound TCP packets, and configure a custom rule to detect and block port scanning.
  4. D
    Configure Security Groups to statelessly log traffic at the subnet level, and use Amazon CloudWatch Logs to trigger alerts for unauthorized SSH attempts.

Answer

Enable VPC Flow Logs on the subnet to capture traffic data, and enable Amazon GuardDuty to analyze the flow logs and generate security findings.
The correct solution involves enabling VPC Flow Logs and Amazon GuardDuty. VPC Flow Logs capture network traffic data at the subnet level without introducing any performance overhead on the EC2 instances. Amazon GuardDuty automatically processes these flow logs out-of-band to identify malicious activity, such as port scanning or unauthorized SSH brute-force attempts.

Step-by-Step Solution

1
Enable VPC Flow Logs for the target subnet.
Network traffic metadata (source, destination, protocol, port, action) is captured out-of-band and published to Amazon CloudWatch Logs or Amazon S3.
This establishes subnet-level traffic visibility without installing agent software or introducing CPU/memory latency on the EC2 instances.
2
Enable Amazon GuardDuty in the AWS account.
GuardDuty automatically reads VPC Flow Logs, Route 53 resolver query logs, and CloudTrail events at the platform level.
This offloads threat detection analysis to a managed service that uses threat intelligence feeds to identify signatures like port scanning.
3
Process GuardDuty findings.
Alerts and findings are generated inside the GuardDuty console and can be sent to Amazon EventBridge for automated notification or remediation.
This ensures the security team receives immediate notification of anomalous activity.

Key Concept

Out-of-band network threat detection using VPC Flow Logs and Amazon GuardDuty
Estimated Time:2m 0s
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic