Examkin

Question

Difficulty: Very hardVPC Flow Logs and Network Monitoring

A SysOps Administrator is investigating potential data exfiltration in a VPC. Multiple Amazon EC2 instances in a private subnet route all outbound internet traffic through a NAT Gateway located in a public subnet. The administrator needs to analyze network traffic to identify the specific private IP addresses of the EC2 instances that are initiating connections to a known malicious external IP address. The administrator attempts to analyze the default VPC Flow Logs on the NAT Gateway’s public network interface, but the `srcaddr` field only displays the NAT Gateway's private IP address.

Which action should the administrator take to identify the initiating internal EC2 instances from the NAT Gateway's network interface?

  1. A
    Create a new custom VPC Flow Log on the NAT Gateway's network interface that includes the `pkt-srcaddr` field, and ensure the administrator's IAM user policy contains the `sts:AssumeRole` permission for the flow logs delivery role rather than `iam:PassRole`.
  2. B
    Configure a default VPC Flow Log on the NAT Gateway's network interface, deliver the logs to an Amazon CloudWatch Logs group, and set the log group retention period to 'Never Expire' to prevent any historical network logs from being deleted during the investigation.
  3. Create a new VPC Flow Log on the NAT Gateway's network interface using a custom format that includes the `pkt-srcaddr` field, and deliver the logs to an Amazon S3 bucket.Answer
  4. D
    Configure a default VPC Flow Log on the NAT Gateway's network interface to publish directly to Amazon EventBridge, and create a rule that triggers an AWS Systems Manager Automation document to extract the initiating EC2 private IP addresses.

Answer

Create a new VPC Flow Log on the NAT Gateway's network interface using a custom format that includes the `pkt-srcaddr` field, and deliver the logs to an Amazon S3 bucket.
The correct option is to create a new VPC Flow Log on the NAT Gateway's network interface using a custom format that includes the `pkt-srcaddr` field, and deliver the logs to an Amazon S3 bucket. The `pkt-srcaddr` field captures the packet-level source IP address of the traffic, which remains the private IP of the initiating EC2 instance, even after passing through a NAT Gateway. This allows the administrator to trace the traffic back to the specific initiating instance directly from the NAT Gateway's interface logs.

Step-by-Step Solution

1
Identify the limitation of default VPC Flow Logs on translation interfaces.
Understand that the default `srcaddr` field on a NAT Gateway's public ENI shows the NAT Gateway's own IP address, obscuring the original source.
In order to find the initiating instances, we need to capture the pre-translation IP address rather than the interface-level address.
2
Determine the correct custom VPC Flow Log field that captures pre-translation IP addresses.
Select the `pkt-srcaddr` field, which records the packet-level source IP address even if it passes through a NAT Gateway.
The `pkt-srcaddr` field preserves the original client IP address before NAT translation occurs.
3
Choose a supported destination that accepts custom VPC Flow Log formats.
Specify Amazon S3 (or CloudWatch Logs) as the destination for the custom flow log.
Both Amazon S3 and CloudWatch Logs support custom VPC Flow Log formats.

Key Concept

Using custom VPC Flow Log formats with packet-level fields (`pkt-srcaddr`) to track original source IP addresses through translation devices like NAT Gateways.
Estimated Time:3m 0s
Rate this question

Topics

VPC Flow Logs and Network Monitoring

More questions from this topic