Examkin

Soru

Zorluk: ZorVPC Security Controls and Traffic Analysis

A SysOps Administrator is investigating malicious outbound HTTP traffic originating from a VPC. Multiple Amazon EC2 instances reside in private subnets and route their outbound traffic to the internet through a NAT Gateway. The administrator has enabled VPC Flow Logs on the public subnet's network interface where the NAT Gateway resides. However, in the default flow logs, the `srcaddr` field for all outbound packets shows the NAT Gateway's private IP address, making it impossible to identify which specific EC2 instance is generating the malicious traffic.

The administrator wants to resolve this issue and successfully configure the logs to be published to a CloudWatch Logs log group.

Which of the following actions should the administrator take to achieve this? (Select TWO.)

  1. Create a new VPC Flow Log with a custom format that includes the `pkt-srcaddr` field to capture the original packet-level source IP address of the traffic passing through the NAT Gateway.Cevap
  2. Create a new VPC Flow Log targeting the private subnets where the EC2 instances reside to capture the traffic at the instance network interfaces before NAT translation.Cevap
  3. C
    Create the CloudWatch Logs delivery role and assign the `sts:AssumeRole` action to the administrator's IAM policy, omitting the `iam:PassRole` action as it is not required for VPC Flow Logs creation.
  4. D
    Modify the route tables of the private subnets to delete the S3 Gateway Endpoint and route all S3-bound traffic through the NAT Gateway so that all outbound traffic is consolidated and captured in the public subnet's default flow logs.
  5. E
    Create the CloudWatch Logs log group and set its retention policy to 'Never expire' to ensure the logs are not deleted, as CloudWatch log groups default to a 14-day retention limit that cannot be modified after the group is created.

Cevap

Create a new VPC Flow Log with a custom format that includes the `pkt-srcaddr` field, and create a new VPC Flow Log targeting the private subnets where the EC2 instances reside.
The option to use a custom flow log format with the `pkt-srcaddr` field is correct because this field captures the original source IP address before NAT translation. The option to enable flow logs on the private subnets is correct because it captures the traffic before it reaches the NAT Gateway, meaning the source IP in the logs will be the actual private IP of the EC2 instance.

Adım Adım Çözüm

1
Analyze the limitation of default VPC Flow Logs on the NAT Gateway interface.
The default format only captures `srcaddr`, which shows the intermediate interface's IP (NAT Gateway private IP) after source NAT has occurred.
To pinpoint the original source EC2 instance, the packet-level source IP before translation must be captured, or the logs must be gathered before the packet reaches the NAT Gateway.
2
Identify the mechanisms to capture the original source IP.
Two mechanisms are available: use a custom flow log format with the `pkt-srcaddr` field on the public interface, or capture flow logs directly on the private subnet or private ENIs before translation.
The custom field `pkt-srcaddr` logs the original packet-level source IP. Alternatively, subnet-level logs capture the traffic at the ENIs of the instances, where the source IP is still the private IP of the instance.
3
Verify creation prerequisites and operational best practices.
The IAM policy of the administrator creating the flow logs must contain the `iam:PassRole` permission to pass the delivery role to the flow logs service. S3 gateway endpoints should not be deleted as they bypass the NAT Gateway to reduce cost, and log group retention should be managed to avoid cost spikes.
This ensures the logging solution can be successfully created and managed without security issues or unnecessary data transfer and storage costs.

Anahtar Kavram

VPC Flow Logs customization and network address translation visibility limitations.
Bu soruyu puanla

Konular

VPC Security Controls and Traffic Analysis

Bu konudan daha fazla soru