Examkin

Question

Difficulty: MediumVPC Security Controls and Traffic Analysis

A SysOps Administrator has configured an Amazon VPC Traffic Mirroring session to send traffic from an Amazon EC2 instance (source) to an appliance instance (target) for deep packet inspection. The administrator notices that the target appliance is not receiving any mirrored packets. Which of the following configuration issues could cause this problem? (Select TWO.)

  1. The security group associated with the traffic mirror target network interface does not allow inbound traffic on UDP port 4789.Answer
  2. The Network ACL of the subnet where the traffic mirror target resides does not allow inbound traffic on UDP port 4789.Answer
  3. C
    The IAM policy attached to the SysOps Administrator's role lacks the iam:PassRole permission for the traffic mirror target's service role.
  4. D
    The Amazon CloudWatch Logs log group associated with the mirror target has a log retention period that has expired, preventing log creation.
  5. E
    The Network ACL rules for the traffic mirror source subnet block outbound ephemeral port traffic (1024-65535) needed to send VXLAN packets.

Answer

The target network interface's security group and target subnet's Network ACL must allow inbound UDP port 4789 traffic.
VPC Traffic Mirroring copies network packets from a source ENI and routes them to a target ENI or Network Load Balancer using VXLAN encapsulation, which uses UDP port 4789. Because the target instance must receive these encapsulated packets, its stateful security group must permit inbound UDP port 4789. In addition, since Network ACLs are stateless, the NACL associated with the target subnet must also explicitly allow inbound traffic on UDP port 4789.

Step-by-Step Solution

1
Identify the protocol and port used by Amazon VPC Traffic Mirroring to encapsulate copied network traffic.
VPC Traffic Mirroring encapsulates raw packets inside VXLAN (UDP port 4789) headers.
This determines which security rules and ports must be opened on the path and at the target.
2
Evaluate the stateful security controls of the target network interface.
The target's security group must permit inbound UDP port 4789 traffic.
Stateful security groups evaluate incoming traffic and will drop VXLAN packets if port 4789 is not explicitly allowed.
3
Evaluate the stateless security controls of the target subnet.
The Network ACL (NACL) for the target's subnet must explicitly permit inbound UDP port 4789 traffic.
Stateless NACLs evaluate traffic at the subnet boundary and must allow the VXLAN traffic port explicitly.

Key Concept

VPC Traffic Mirroring relies on VXLAN encapsulation on UDP port 4789, requiring both target security groups and Network ACLs to permit this inbound traffic.
Rate this question

Topics

VPC Security Controls and Traffic Analysis

More questions from this topic