Examkin

Soru

Zorluk: OrtaSecurity Monitoring and Threat Detection

A company's security team needs to monitor network traffic for a multi-tier web application. They suspect that a compromised Amazon EC2 instance in a private subnet is attempting to perform unauthorized network scans on other resources within the same Virtual Private Cloud (VPC). The team needs to capture the source IP, destination IP, source port, destination port, and protocol for all network traffic at the subnet level without installing any host-based software. Which solution will meet these requirements?

  1. A
    Deploy AWS WAF on the subnet to monitor and log all Layer 3 and Layer 4 IP traffic flowing between the EC2 instances.
  2. B
    Configure Network ACLs on the private subnet to log all connection metadata directly to AWS CloudTrail.
  3. Enable VPC Flow Logs on the private subnet and publish the logs to an Amazon S3 bucket.Cevap
  4. D
    Enable AWS Shield Advanced on the VPC to log internal host-to-host traffic metadata.

Cevap

Enable VPC Flow Logs on the private subnet and publish the logs to an Amazon S3 bucket.
The correct solution is to enable VPC Flow Logs on the private subnet and publish the logs to an Amazon S3 bucket. VPC Flow Logs captures IP traffic metadata (source/destination IPs, ports, and protocol) at the Elastic Network Interface (ENI) level without needing any agents. It can deliver these logs to Amazon S3 or CloudWatch Logs.

Adım Adım Çözüm

1
Identify the requirement to capture network flow data (source/destination IPs, ports, and protocols) at the subnet level.
Determined that network traffic metadata monitoring is required.
This establishes the scope of traffic metadata that needs to be collected.
2
Evaluate native AWS logging capabilities that operate agentlessly at the network boundary.
Identified VPC Flow Logs as the native feature designed to capture flow information for subnets, network interfaces, or VPCs without requiring host-based software.
The business scenario forbids host-based software, ruling out agent-based monitoring utilities.
3
Select a valid destination for the captured log data.
Configured the flow logs to publish to Amazon S3, which supports durable, secure, and cost-effective log storage.
VPC Flow Logs natively supports publishing to Amazon S3 or Amazon CloudWatch Logs.

Anahtar Kavram

Agentless network traffic metadata logging via VPC Flow Logs
Bu soruyu puanla

Konular

Security Monitoring and Threat Detection

Bu konudan daha fazla soru