Examkin

Soru

Zorluk: OrtaVPC Security Controls and Traffic Analysis

A SysOps Administrator is configuring VPC Traffic Mirroring to capture a copy of inbound HTTPS traffic from a production application server's network interface (10.0.1.10) in a VPC. The mirrored traffic must be sent to an intrusion detection system (IDS) instance (10.0.2.20) in a different subnet of the same VPC. The administrator has successfully configured the Traffic Mirror Source, the Traffic Mirror Target, and a Traffic Mirror Filter to capture inbound TCP port 443 traffic. However, the IDS instance is not receiving any mirrored packets. Which configuration change should the administrator make to allow the mirrored traffic to reach the IDS instance?

  1. Add a rule to the security group of the IDS instance to allow inbound UDP traffic on port 4789 from the source network interface.Cevap
  2. B
    Add a rule to the Network ACL of the target subnet to allow inbound TCP traffic on ports 1024-65535 from the source subnet.
  3. C
    Add a route to the route table of the source subnet targeting the Internet Gateway for the IDS instance's IP address.
  4. D
    Assign an IAM role with the iam:PassRole permission to the source EC2 instance to allow the Traffic Mirror session to write to the target.

Cevap

Add a rule to the security group of the IDS instance to allow inbound UDP traffic on port 4789 from the source network interface.
The correct answer is to allow inbound UDP traffic on port 4789 from the source network interface. VPC Traffic Mirroring encapsulates mirrored network packets in a VXLAN header, which uses UDP destination port 4789. Because security groups are stateful and block unsolicited traffic by default, the security group of the target IDS instance must be configured to allow this inbound UDP traffic to receive the mirrored packets.

Adım Adım Çözüm

1
Analyze the encapsulation protocol used by AWS VPC Traffic Mirroring.
Identify that VPC Traffic Mirroring copies physical layer packets and encapsulates them into VXLAN packets using UDP port 4789.
This determines which port and protocol must be allowed through security controls to deliver the mirrored traffic.
2
Evaluate the target instance's security group configuration.
Realize that security groups are stateful, but because the VXLAN packet delivery is one-way from source to target, the target's security group must explicitly allow inbound UDP port 4789 from the source ENI.
If the security group does not allow UDP port 4789, it will block the incoming VXLAN packets at the hypervisor level.
3
Differentiate between VPC-internal local routing and external routing.
Confirm that since both subnets are in the same VPC, the system route table's local route automatically handles the traffic routing, meaning no additional routes or gateways are required.
This rules out any need for custom route table modifications targeting an Internet Gateway.

Anahtar Kavram

VPC Traffic Mirroring relies on VXLAN encapsulation (UDP port 4789) to copy and send packets to the target ENI, requiring target security groups to permit this inbound traffic.
Bu soruyu puanla

Konular

VPC Security Controls and Traffic Analysis

Bu konudan daha fazla soru