Examkin

Question

Difficulty: MediumVPC Flow Logs and Network Monitoring

A SysOps Administrator is troubleshooting a network connectivity issue where external clients cannot connect to a web server running on an Amazon EC2 instance. The web server's Security Group allows inbound TCP port 80 from all sources and allows all outbound traffic. The subnet's Network ACL (NACL) allows inbound TCP port 80 from all sources, but the outbound NACL rules have been modified to deny all traffic. To analyze this, the administrator enables VPC Flow Logs. Additionally, the administrator wants to configure the destination CloudWatch Logs group to minimize costs and automatically alert the operations team if the number of rejected packets exceeds a threshold. Which two of the following statements correctly describe the behavior of the flow logs or the configuration required to meet these monitoring and cost requirements? (Select TWO.)

  1. The flow logs will record an ACCEPT status for the inbound traffic on port 80, and a REJECT status for the outbound response traffic.Answer
  2. The CloudWatch Log Group must be configured with a retention policy to automatically expire older events, and a metric filter must be created to track REJECT records.Answer
  3. C
    The flow logs will record a REJECT status for the inbound traffic on port 80 because security groups are stateless and evaluate return paths before accepting a connection.
  4. D
    The alerts must be configured by creating an Amazon EventBridge rule that directly monitors the VPC Flow Logs API and routes matching events to an Amazon SNS topic.
  5. E
    The log retention must be configured directly within the VPC Flow Log definition settings because CloudWatch Log Groups do not support individual retention configurations.

Answer

The flow logs will record an ACCEPT status for the inbound traffic on port 80 and a REJECT status for the outbound response traffic, and the CloudWatch Log Group must be configured with a retention policy to automatically expire older events alongside a metric filter to track REJECT records.
The correct options identify that the inbound traffic will be marked as ACCEPT while the outbound response is marked as REJECT, and that the retention policy must be configured on the CloudWatch Log Group alongside a metric filter. Because security groups are stateful and Network ACLs are stateless, the inbound connection is allowed by the security group and the inbound NACL, but the outbound response is blocked by the modified outbound NACL. Additionally, managing storage costs is handled by the CloudWatch Log Group's retention policy, and extracting patterns for alerting requires a CloudWatch Metric Filter.

Step-by-Step Solution

1
Analyze the stateful behavior of the security group and the stateless behavior of the Network ACL on inbound traffic.
The inbound traffic is allowed by both the security group and the inbound NACL on port 80, resulting in an ACCEPT record.
For inbound traffic to be accepted, both the security group and the inbound NACL must explicitly permit the traffic.
2
Analyze the return path of the response traffic.
The stateful security group allows the response automatically, but the stateless NACL evaluates the outbound rule (deny all) and drops the packet, resulting in a REJECT record.
NACLs are stateless and evaluate traffic in each direction independently, whereas security groups track connection states.
3
Determine the proper configuration for retention and alarms in CloudWatch Logs.
Configure a retention policy on the target CloudWatch Log Group to control costs, and create a metric filter to monitor the REJECT pattern in log data.
Retention policies are resource-level settings in CloudWatch Logs, and metric filters extract metric data from raw log events to drive CloudWatch Alarms.

Key Concept

Stateful vs. stateless network filtering in VPC Flow Logs interpretation and target log group management.
Estimated Time:2m 0s
Rate this question

Topics

VPC Flow Logs and Network Monitoring

More questions from this topic