Examkin

Soru

Zorluk: OrtaVPC Security Controls and Traffic Analysis

A SysOps Administrator is designing a security and monitoring architecture for a database tier containing private Amazon RDS DB instances. The database instances must only accept MySQL traffic on port 3306 from the application tier subnets, and all network traffic to and from the database subnet must be monitored using VPC Flow Logs sent to Amazon CloudWatch Logs. The administrator must ensure that the IAM role used by the flow logs can publish to CloudWatch Logs and that log storage costs are managed efficiently. Which of the following actions should the administrator perform to meet these requirements? (Select TWO.)

  1. Configure the destination Amazon CloudWatch Logs group with a specific retention period, such as 90 days, instead of the default setting of Never Expire.Cevap
  2. B
    Configure the CloudWatch Logs group to keep logs indefinitely and set up a daily scheduled Amazon EventBridge rule to export the logs to Amazon S3.
  3. Create the VPC Flow Log using an IAM role that has a trust relationship with the VPC Flow Logs service principal and contains the necessary logs write permissions, ensuring the administrator has the permission to pass this role.Cevap
  4. D
    Create the VPC Flow Log using an IAM role that has an AWS-managed policy for EC2 access, without configuring a trust relationship for the VPC Flow Logs service principal or granting the administrator permission to pass the role.
  5. E
    Modify the database subnet's Network ACL to allow inbound TCP traffic on port 3306 from the application subnet, and allow outbound TCP traffic on port 3306 to the application subnet, without allowing outbound ephemeral ports.

Cevap

To secure and monitor the database subnets while keeping costs low, the CloudWatch Logs group must be configured with a specific retention period to prevent infinite storage fees, and the VPC Flow Log must be created using an IAM role that trusts the flow logs service principal, has write permissions to CloudWatch, and is passed by an administrator who possesses the iam:PassRole permission.
Configuring a specific retention period on the CloudWatch Logs group ensures that log data does not accumulate indefinitely, minimizing storage costs. Furthermore, creating the VPC Flow Log requires an IAM role with a trust relationship that allows the VPC Flow Logs service principal to assume it, and the administrator must have the iam:PassRole permission to attach this role to the flow log.

Adım Adım Çözüm

1
Set a retention limit on the destination CloudWatch Logs group.
The log group automatically purges logs older than the defined period (e.g., 90 days).
By default, CloudWatch Logs are kept forever, resulting in continuous growth of storage costs. Specifying a retention period controls costs.
2
Set up the IAM role for the VPC Flow Logs and ensure correct trust and permission policies are present.
The Flow Logs service principal is authorized to assume the role, and the user can pass the role to the service.
VPC Flow Logs need permission to call CreateLogStream and PutLogEvents. The role's trust policy must allow vpc-flow-logs.amazonaws.com to assume it, and the SysOps Administrator needs iam:PassRole to assign the role to the flow log.

Anahtar Kavram

VPC Flow Logs IAM roles and CloudWatch retention policies are critical components for secure traffic auditing and cost optimization in AWS networking.
Bu soruyu puanla

Konular

VPC Security Controls and Traffic Analysis

Bu konudan daha fazla soru