Examkin

Question

Difficulty: HardVPC Security Controls and Traffic Analysis

An organization wants to perform deep packet inspection on traffic directed to a backend application server in a private subnet. A SysOps Administrator configures an Amazon VPC Traffic Mirroring session. The mirror source is the primary Elastic Network Interface (ENI) of the application server, which is running on a t2.mediumt2.medium EC2 instance. The mirror target is a security monitoring tool running on a c5.largec5.large EC2 instance in the same VPC.

The Security Group of the c5.largec5.large target instance is configured to allow inbound UDP traffic on port 47894789. The Security Group of the t2.mediumt2.medium source instance permits all inbound traffic from the application's load balancer, but its outbound rules restrict traffic to 0.0.0.0/00.0.0.0/0 on TCP ports 8080 and 443443 only. The Network ACLs associated with both subnets allow all traffic.

The administrator notices that no mirrored traffic is being received by the monitoring tool.

Which two modifications must the administrator make to resolve this issue and enable successful packet mirroring?

  1. Modify the outbound rules of the t2.mediumt2.medium instance's Security Group to permit UDP port 47894789 traffic to the monitoring tool.Answer
  2. Change the application server's instance type from t2.mediumt2.medium to a Nitro-based instance type, such as t3.mediumt3.medium.Answer
  3. C
    Add an inbound rule to the private subnet's Network ACL to allow traffic from ephemeral ports 10241024-6553565535.
  4. D
    Attach an IAM role with the iam:PassRole permission to the VPC Traffic Mirroring target resource.
  5. E
    Add a route targeting the Internet Gateway in the private subnet's route table to permit Traffic Mirroring packet routing.

Answer

To resolve the issue, the administrator must change the application server's instance type from a Xen-based t2.mediumt2.medium to a Nitro-based instance type (such as t3.mediumt3.medium) and modify the outbound rules of the source instance's Security Group to permit UDP port 47894789 traffic to the monitoring tool.
VPC Traffic Mirroring requires Nitro-based instances (such as t3.mediumt3.medium) for the source. Additionally, mirrored traffic is encapsulated in VXLAN headers (UDP port 47894789) and is subject to the security group rules of the mirror source. Therefore, the source instance's Security Group must allow outbound UDP port 47894789 traffic.

Step-by-Step Solution

1
Evaluate source instance hardware platform support for VPC Traffic Mirroring.
Identify that the t2.mediumt2.medium instance type is Xen-based and does not support Traffic Mirroring as a source.
VPC Traffic Mirroring sources must be Nitro-based instance types.
2
Analyze security group rules on the mirror source ENI.
Identify that the outbound Security Group rules on the source instance block UDP port 47894789 traffic.
Mirrored traffic is encapsulated in VXLAN (UDP port 47894789) and is evaluated against the source instance's stateful Security Group.
3
Formulate remediation steps for the identified blockages.
Upgrade the instance type to a Nitro-based type (e.g., t3.mediumt3.medium) and update the Security Group rules to allow outbound UDP 47894789 traffic.
Both hardware support and security group path clearance are required for mirrored packets to reach the target.

Key Concept

VPC Traffic Mirroring Requirements and Security Group Constraints
Rate this question

Topics

VPC Security Controls and Traffic Analysis

More questions from this topic