Exam AWS Certified Security - Specialty topic 1 question 228 discussion

C: https://aws.amazon.com/blogs/aws/new-vpc-traffic-mirroring/

VPC traffic mirroring allows the security engineer to capture and inspect network traffic at the Elastic Network Interface (ENI) level. By configuring traffic mirroring, the engineer can select the desired ENIs associated with the application instances and mirror their traffic to the monitoring EC2 instance. This ensures that all inbound and outbound traffic to and from the application instances is sent to the intrusion detection software for analysis.

VCP traffic mirroring is the most effective way to protect cloud workloads. Threat detection and continuous security monitoring in cloud environments have to integrate security monitoring of instances and images (system monitoring), just as they do on premises. However in the cloud we need to monitor the management plane and the data flowing inside and out of the virtual private network. Amazon VPC Traffic Mirroring addresses these challenges and enables customers to natively replicate their network traffic without having to install and run packet forwarding agents on Amazon EC2 instances. Amazon VPC Traffic Mirroring captures packets at the ENI level, which cannot be tampered with from the user space, thus offering better security. C

C is the answer

Promiscuous mode doesn't work in AWS. You can think of VPC Traffic Mirroring as a “virtual fiber tap” that gives you direct access to the network packets flowing through your VPC. As you will soon see, you can choose to capture all traffic or you can use filters to capture the packets that are of particular interest to you, with an option to limit the number of bytes captured per packet. You can use VPC Traffic Mirroring in a multi-account AWS environment, capturing traffic from VPCs spread across many AWS accounts and then routing it to a central VPC for inspection

Only C makes sense. But why NLB in front of a single target?

Answer C -->VPC Traffic Monitoring https://aws.amazon.com/blogs/aws/new-vpc-traffic-mirroring/

C is the answer

C. Traffic mirroring to send network logs to IDS on the host.

C. Use VPC traffic mirroring to send network logs to the IDS.