Examkin

Question

Difficulty: HardSecurity Monitoring and Threat Detection

A logistics company's security operations team suspects that an Amazon EC2 instance in a private subnet is compromised and communicating with a malicious command-and-control server. The team must capture network flow details, including source and destination IP addresses, ports, and protocols, to confirm this activity and analyze the connection patterns. The logging solution must capture all traffic without altering the existing network architecture or impacting network performance. Which strategy should the solutions architect recommend to monitor this network traffic?

  1. Enable VPC Flow Logs on the subnet, publishing the logs to an Amazon S3 bucket, and use Amazon Athena to query and analyze the traffic details.Answer
  2. B
    Enable logging on the subnet's Network ACLs to record all traffic flows, and configure security groups to dynamically track the stateful return traffic.
  3. C
    Deploy AWS WAF at the VPC subnet level to inspect all inbound and outbound traffic, and configure WAF logging to save network flows to Amazon S3.
  4. D
    Enable AWS Shield Advanced on the EC2 instances to monitor network-level flow data, and use the AWS Shield console to investigate outbound connections.

Answer

Enable VPC Flow Logs on the subnet, publishing the logs to an Amazon S3 bucket, and use Amazon Athena to query and analyze the traffic details.
Enabling VPC Flow Logs at the subnet level allows the security team to capture metadata about the IP traffic going to and from network interfaces in the subnet. Since VPC Flow Logs is an out-of-band feature, it has no impact on network latency or throughput. Storing these logs in Amazon S3 and querying them using Amazon Athena provides a highly scalable and cost-effective method to analyze the network flow data, locate the destination IP addresses, and verify whether the connections were accepted or rejected.

Step-by-Step Solution

1
Identify the requirement to monitor and analyze all traffic going to and from network interfaces in a VPC subnet without affecting latency or performance.
Determine that VPC Flow Logs is the native AWS feature designed to capture IP traffic metadata without impacting performance, as it operates out-of-band.
Allows the security team to collect metadata about network connections (source, destination, protocol, ports) without deploying agents or inline appliances.
2
Determine the appropriate log destination and analysis tool for querying the captured flow metadata.
Select Amazon S3 as the cost-effective storage target, and Amazon Athena to query the log files directly using standard SQL.
Aligns with AWS security and storage best practices, enabling ad-hoc forensic queries without the overhead of indexing or running a continuous search cluster.

Key Concept

VPC Flow Logs for network threat detection and monitoring
Estimated Time:2m 0s
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic