exam questions

Exam ANS-C00 All Questions

View all questions & answers for the ANS-C00 exam

Exam ANS-C00 topic 1 question 373 discussion

Exam question from Amazon's ANS-C00
Question #: 373
Topic #: 1
[All ANS-C00 Questions]

A company is deploying a critical application on two Amazon EC2 instances in a VPC. Failed client connections to the EC2 instances must be logged according to company policy.
What is the MOST cost-effective solution to meet these requirements?

  • A. Move the EC2 instances to a dedicated VPC. Enable VPC Flow Logs with a filter on the deny action. Publish the flow logs to Amazon CloudWatch Logs.
  • B. Move the EC2 instances to a dedicated VPC subnet. Enable VPC Flow Logs for the subnet with a filter on the reject action. Publish the flow logs to an Amazon Kinesis Data Firehose stream with a data delivery to an Amazon S3 bucket.
  • C. Enable VPC Flow Logs, filtered for rejected traffic, for the elastic network interfaces associated with the instances. Publish the flow logs to an Amazon Kinesis Data Firehose stream with a data delivery to an Amazon S3 bucket.
  • D. Enable VPC Flow Logs, filtered for rejected traffic, for the elastic network interfaces associated with the instances. Publish the flow logs to Amazon CloudWatch Logs.
Show Suggested Answer Hide Answer
Suggested Answer: A 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
walkwolf3
Highly Voted 3 years, 8 months ago
D There is no such deny action in flow log. The action that is associated with the traffic: ACCEPT — The recorded traffic was permitted by the security groups and network ACLs. REJECT — The recorded traffic was not permitted by the security groups or network ACLs.
upvoted 11 times
walkwolf3
3 years, 7 months ago
https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html#flow-logs-fields
upvoted 1 times
...
...
clooudy
Most Recent 3 years ago
Selected Answer: D
Answer: D enable VPC flow logs, filter it on Reject for the enis and send to cloudwatch
upvoted 2 times
...
khchan123
3 years, 3 months ago
It's C. -> REJECTED filter for VPC Flow log -> Store log in S3 instead of CloudWatch Logs.
upvoted 1 times
sapien45
3 years, 2 months ago
Kinesis is much more expansive than Cloudwatch. D
upvoted 3 times
...
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...