Examkin

Question

Difficulty: HardVPC Flow Logs and Network Monitoring

A SysOps Administrator is investigating high data transfer costs in a VPC. An application running on Amazon EC2 instances in a private subnet frequently communicates with external endpoints and AWS services. The administrator suspects that some traffic destined for Amazon S3 is being routed through a NAT Gateway instead of a configured VPC Gateway Endpoint for S3. The administrator decides to create a VPC Flow Log with a custom format to identify this traffic. Which of the following actions should the administrator take to verify whether traffic destined for Amazon S3 is traversing the NAT Gateway? (Select TWO.)

  1. Create a custom flow log format that includes the `pkt-dstaddr` field to capture the final destination IP address of the packets rather than the network interface destination IP.Answer
  2. Create a custom flow log format that includes the `traffic-path` field to identify whether egress traffic is routed through a NAT gateway or a gateway VPC endpoint.Answer
  3. C
    Create a default VPC Flow Log and check the `dstaddr` field, which will display the Amazon S3 public IP address as the destination for traffic flowing from the EC2 instance through the NAT Gateway.
  4. D
    Associate the subnet's route table with a Gateway VPC Endpoint for Amazon S3, then verify that the flow log's `dstaddr` field automatically changes from the NAT Gateway IP to the VPC endpoint service name.
  5. E
    Create a custom flow log format that includes the `flow-direction` field, and verify that the value is set to `ingress` for the outbound traffic going from the EC2 instances to Amazon S3.

Answer

Create a custom flow log format that includes the `pkt-dstaddr` field, and create a custom flow log format that includes the `traffic-path` field.
To determine if traffic is traversing the NAT Gateway rather than using a Gateway VPC Endpoint, custom VPC Flow Log fields are required. The `pkt-dstaddr` field captures the packet-level destination IP address, which remains the S3 public IP address even when traffic passes through the NAT Gateway. In contrast, the standard `dstaddr` field would only show the private IP address of the NAT Gateway's network interface. Additionally, the `traffic-path` field provides a direct indicator of the egress route, where a value of 2 signifies a NAT Gateway and a value of 5 signifies a gateway VPC endpoint.

Step-by-Step Solution

1
Identify the limitations of default VPC Flow Logs when traffic traverses an intermediate device like a NAT Gateway.
Determine that the standard `dstaddr` field only captures the next-hop ENI destination (the NAT Gateway private IP) and not the final destination.
To trace the actual destination of traffic passing through a NAT Gateway, packet-level destination details are needed.
2
Analyze custom VPC Flow Log fields for packet-level tracking and routing path indicators.
Identify `pkt-dstaddr` to capture the final packet destination IP and `traffic-path` to identify the egress route type (value 2 for NAT Gateway, value 5 for Gateway VPC Endpoint).
These fields allow direct correlation between the destination service and the routing path used.
3
Evaluate the incorrect options for flow direction, S3 service name resolution, and default log field behavior.
Eliminate options proposing default logs for S3 destination tracking, expecting service names in flow logs, or using 'ingress' direction for outbound traffic.
Ensures the selected configuration steps accurately address the diagnostic requirements.

Key Concept

Custom VPC Flow Logs allow administrators to capture advanced metadata, such as packet-level IP addresses (`pkt-dstaddr`) and routing paths (`traffic-path`), which is essential when diagnosing traffic flow through intermediate interfaces like NAT Gateways.
Rate this question

Topics

VPC Flow Logs and Network Monitoring

More questions from this topic