Exam ANS-C00 topic 1 question 283 discussion

Exam question from Amazon's ANS-C00

Question #: 283
Topic #: 1

You are the network engineer at your company, and you are noticing issues with QoS in you're the traffic to your instances hosting a VOIP program. You need to inspect the network packets to determine if it is a programming error or a networking error. How should you do this?

A. Configure a network monitoring program on every instance and stream the logs to an S3 bucket to be parsed.
B. Use CloudWatch
C. Set up another instance with an ENI added to act as a monitoring interface. Set the port to "promiscuous mode" and sniff the traffic to analyze the packets. Then output this single stream to an S3 bucket to be parsed.
D. Inspect Flow Logs

Show Suggested Answer

Suggested Answer: A 🗳️
Flow Logs and CloudWatch do not display packet contents. You cannot sniff traffic destined for other instances.

by KMak at Dec. 29, 2020, 3:36 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

sapien45

3 years, 2 months ago

this is a question pertinent to the pre era of VPC Mirroring. reponse A would be the most adequete answer

upvoted 4 times

...

Huy

3 years, 7 months ago

A is the correct answer. "promiscuous mode" in a new instance will not help because it only detects traffic to the instance. I can't sniff traffic in VPC.

upvoted 2 times

...

ChauPhan

3 years, 7 months ago

A. Configure a network monitoring program on every instance and stream the logs to an S3 bucket to be parsed.

upvoted 1 times

...

eeghai7thioyaiR4

3 years, 7 months ago

Promiscuous mode does not work as intended inside a VPC A is the correct answer

upvoted 2 times

...

VEV

3 years, 7 months ago

IMO it is A because even though now AWS support VPC Traffic mirroring but if you look at the C, it says - Set the port to "promiscuous mode" and sniff the traffic to analyze the packets. Then output this single stream to an S3 bucket to be parsed - which is not there. Destination for VPC Traffic Mirroring is either ENI or NLB NOT S3 here. Closest would be A. I hope this wont come up in exam :(

upvoted 4 times

...

KMak

3 years, 8 months ago

https://medium.com/@macsat101/packet-sniffing-using-wireshark-on-aws-183b7983685d

upvoted 1 times

...

KMak

3 years, 8 months ago

Answer is "C" as of June 2019, you can enable VPC Traffic Monitoring using ENI interface https://aws.amazon.com/blogs/aws/new-vpc-traffic-mirroring/

upvoted 2 times

doski

3 years, 8 months ago

Read the question again, Option "C" is talking about sniffing packet from a "new instance", hence, A is the most appropriate answer in this context

upvoted 1 times

...