A Network Engineer needs to be automatically notified when a certain TCP port is accessed on a fleet of Amazon EC2 instances running in an Amazon VPC. Which of the following is the MOST reliable solution?
A.
Create an inbound rule in the VPC's network ACL that matches the TCP port. Create an Amazon CloudWatch alarm on the NetworkPackets metric for the ACL that uses Amazon SNS to notify the Administrator when the metric is greater than zero.
B.
Install intrusion detection software on each Amazon EC2 instance and configure it to use the AWS CLI to notify the Administrator with Amazon SNS each time the TCP port is accessed.
C.
Create VPC Flow Logs that write to Amazon CloudWatch Logs, with a metric filter matching connections on the required port. Create a CloudWatch alarm on the resulting metric that uses Amazon SNS to notify the Administrator when the metric is greater than zero.
D.
Install intrusion detection software on each Amazon EC2 instance and configure it to use the AWS CLI to publish to a custom Amazon CloudWatch metric each time the TCP port is accessed. Create a CloudWatch alarm on the resulting metric that uses Amazon SNS to notify the Administrator when the metric is greater than zero.
B, D are not reliable, when the EC2 is down or the application is turned off. Also it's management overhead and need to install to all EC2.
A. Haven't heard about NetworkPacket metrics of ACL and how it's relevant
C sounds good.
NetworkPacketsIn metrics is not even relevant for this question. The definition is as follows
The number of packets received by the instance on all network interfaces. This metric identifies the volume of incoming traffic in terms of the number of packets on a single instance.
C is the right answer.
This section is not available anymore. Please use the main Exam Page.ANS-C00 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
[Removed]
Highly Voted 3 years, 8 months agoChauPhan
Highly Voted 3 years, 7 months agoAlgoproxy
Most Recent 2 years, 7 months agoCCNPWILL
2 years, 8 months agoMarty2021
2 years, 11 months agokhchan123
3 years, 3 months agoExamTopicsFan
3 years, 8 months agoThiagosilvanetwork
3 years, 8 months agoguruguru
3 years, 8 months agoLexyA
3 years, 8 months ago