AWS Certified Advanced Networking - Specialty ANS-C01 — Topic 1 Question 61

Question

A company has deployed an application in a VPC that uses a NAT gateway for outbound traffic to the internet. A network engineer notices a large quantity of suspicious network traffic that is traveling from the VPC over the internet to IP addresses that are included on a deny list. The network engineer must implement a solution to determine which AWS resources are generating the suspicious traffic. The solution must minimize cost and administrative overhead. Which solution will meet these requirements?

Accepted Answer

Correct answer: C. The correct answer is C. Option C: Use VPC flow logs. Publish the flow logs to a log group in Amazon CloudWatch Logs. Use CloudWatch Logs Insights to query the flow logs to identify the AWS resources that are generating the suspicious traffic. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. This option delivers the requirement at the lowest cost.

AWS Certified Advanced Networking - Specialty ANS-C01 — Question 61