Examkin

Soru

Zorluk: Çok zorVPC Security Controls and Traffic Analysis

A SysOps Administrator is implementing Amazon VPC Traffic Mirroring to inspect network packets from a critical production database instance (source) located in subnet A to an Intrusion Detection System (IDS) security appliance (target) located in subnet B. Both subnets are protected by custom Network ACLs, and the security groups for both the database and the IDS allow all traffic. The administrator configures a Traffic Mirror Filter to capture all inbound and outbound TCP traffic. The traffic mirroring session is active, but the IDS appliance is not receiving any mirrored packets.

Which of the following configuration changes or verification steps should the administrator perform to resolve this issue? (Select TWO.)

  1. Verify that the Network ACL associated with subnet B allows inbound UDP traffic on port 47894789, and the Network ACL for subnet A allows outbound UDP traffic on port 47894789.Cevap
  2. Ensure that the EC2 instances hosting the database and the IDS appliance are both launched on supported Nitro-based instance types.Cevap
  3. C
    Modify the Network ACL of subnet A to allow outbound TCP traffic on ephemeral ports 10241024-6553565535 to permit return packets from the mirrored TCP connections.
  4. D
    Configure the route tables of both subnets to direct traffic mirroring packets through a NAT Gateway to enable transit routing between the two subnets.
  5. E
    Associate an IAM role with the database EC2 instance that includes the `iam:PassRole` permission to authorize the instance to send packets to the target ENI.

Cevap

Verify that the Network ACL associated with subnet B allows inbound UDP traffic on port 47894789, and the Network ACL for subnet A allows outbound UDP traffic on port 47894789, and ensure that the EC2 instances hosting the database and the IDS appliance are both launched on supported Nitro-based instance types.
VPC Traffic Mirroring encapsulates mirrored traffic using VXLAN (UDP port 47894789). Since Network ACLs evaluate mirrored packets and are stateless, the source subnet's Network ACL must permit outbound UDP port 47894789 traffic, and the target subnet's Network ACL must permit inbound UDP port 47894789 traffic. Additionally, Traffic Mirroring requires supported instance types, such as Nitro-based instances, to copy traffic from the network interface.

Adım Adım Çözüm

1
Identify the protocol used for traffic encapsulation in VPC Traffic Mirroring.
VPC Traffic Mirroring encapsulates packets in VXLAN headers, which use UDP port 47894789.
This determines which ports must be allowed in the network path controls.
2
Review the Network ACL configuration of the source and target subnets.
Verify that the stateless Network ACLs allow outbound UDP port 47894789 from the source subnet and inbound UDP port 47894789 to the target subnet.
Because Network ACLs are stateless and evaluate mirrored traffic, they must explicitly allow this encapsulation traffic.
3
Verify instance type compatibility for the source and target instances.
Confirm that both the database and the IDS appliance run on supported instance types (primarily Nitro-based).
VPC Traffic Mirroring requires specific hardware virtualization capabilities present on Nitro instances.

Anahtar Kavram

VPC Traffic Mirroring relies on VXLAN encapsulation (UDP port 47894789) and requires supported instance types. Unlike security groups, Network ACLs are stateless and evaluate mirrored traffic.
Bu soruyu puanla

Konular

VPC Security Controls and Traffic Analysis

Bu konudan daha fazla soru