A company's security team needs to monitor network traffic entering and leaving their Amazon VPC. They want to identify potential security threats, detect anomalous traffic, and capture details about the IP traffic flowing through the network interfaces. Which two actions should the solutions architect recommend to implement this security monitoring? (Select TWO.)
- Enable VPC Flow Logs on the target VPC to capture IP traffic details for network interfaces.Cevap
- Publish the flow log data to an Amazon CloudWatch Logs log group to enable querying and analysis.Cevap
- CDeploy AWS Shield Advanced on the VPC subnets to inspect and block Layer 7 SQL injection attacks.
- DConfigure stateful Network ACLs at the subnet level to automatically track and log session state for all inbound traffic.
- EEnable AWS WAF on the subnet route tables to monitor network-layer routing anomalies.
Cevap
Enable VPC Flow Logs on the target VPC to capture IP traffic details for network interfaces, and publish the flow log data to an Amazon CloudWatch Logs log group to enable querying and analysis.
The correct combination of actions is to enable VPC Flow Logs on the target VPC to capture metadata about IP traffic, and to publish those logs to Amazon CloudWatch Logs (or Amazon S3) for querying and analysis. This aligned architectural approach captures network-level traffic data without agent overhead and allows direct querying to discover anomalous traffic.
Adım Adım Çözüm
Anahtar Kavram
VPC Flow Logs capture network traffic metadata at the VPC, subnet, or elastic network interface level, and can be published to CloudWatch Logs or Amazon S3 for security monitoring.