Exam AWS Certified Security - Specialty topic 1 question 132 discussion

Correct VPC flowlogs will help you to detect the network traffic in VPC and NACL outbound to block traffic

C for me

C is the right answer.

The VPC flow logs can be used to identify the C2 traffic which is using port 5353.

To quickly identify all compromised hosts and stop the egress of data on port 5353, the following steps can be taken: Create an Amazon CloudWatch custom metric on the VPC Flow Logs identifying egress traffic on port 5353. This will allow you to monitor and identify any hosts that are exfiltrating data on port 5353. Update the NACLs to block port 5353 outbound. This will prevent any further exfiltration of data on port 5353. Option C is the best solution because it allows you to quickly identify the compromised hosts and stop the egress of data on port 5353 using VPC Flow Logs and NACLs.

It it VPCFlow Logs and not CloudTrail that contains port information. and Inspector is not supported on ECS

C and Not B , because in network reachability package of inspector does not support ECR https://docs.aws.amazon.com/inspector/latest/user/findings-types.html. Thanks Hariru for the nudge in the right direction

why not B ? inspector is good service to dectect vulnerability ?

C is the correct answer

Its C because: D is saying Cloudtrail, which doesnt have any port information. Additionally SG cant block. B says inspector which is for EC2 A says total nonsense.

C for me as well.

it's D. The question is talking about ECS not a VPC

C, for sure.

c is correct

C to me