Exam AWS Certified Solutions Architect - Professional topic 1 question 942 discussion

D The question already states that there was an Action=Accept from Internet inbound to Private IP. The goal is to determine if this was solicited or unsolicited traffic. If solicited, traffic would have been initiated from the Private IP address initially and then received the return traffic. If unsolicited, there would be no initial traffic outbound from Private IP address. So Answer D is what is needed to determine this.

https://aws.amazon.com/premiumsupport/knowledge-center/vpc-analyze-inbound-traffic-nat-gateway/

B https://repost.aws/knowledge-center/vpc-analyze-inbound-traffic-nat-gateway from aws documentation: filter (dstAddr like 'xxx.xxx' and srcAddr like 'public IP') | stats sum(bytes) as bytesTransferred by srcAddr, dstAddr | limit 10 if the query results show traffic ONLY ON the NAT gateway private IP from the public IP, BUT NOT traffic on other private IPs in the VPC, these results confirm that the incoming traffic was unsolicited.

same question in version 2 https://www.examtopics.com/discussions/amazon/view/95384-exam-aws-certified-solutions-architect-professional-sap-c02/ B is correct

Flow log data can be published to the following locations: Amazon CloudWatch Logs, Amazon S3, or Amazon Kinesis Data Firehose. - A is out.

https://aws.amazon.com/premiumsupport/knowledge-center/vpc-analyze-inbound-traffic-nat-gateway/

Correct B.

should be B Cloudxie posted this link here you can see https://aws.amazon.com/premiumsupport/knowledge-center/vpc-analyze-inbound-traffic-nat-gateway/ filter (dstAddr like 'xxx.xxx' and srcAddr like 'public IP') | stats sum(bytes) as bytesTransferred by srcAddr, dstAddr | limit 10 Query results show traffic on the NAT gateway private IP from the public IP, but not traffic on other private IPs in the VPC. These results confirm that the incoming traffic was unsolicited. However, if you do see traffic on the private instance's IP, then follow the steps under Reason

Cloudtrail isn't used to view VPC flow logs, so that rules out A and C. Traffic is already allowed inbound, so need to see if there is suspicious traffic from the source/internal/private range = 203.0 Source = 203.x Dest = 198.51

As a networking guy, D is the obvious answer. You are inspecting the CW log group for the outbound traffic.

B: Cloudxie added the link https://aws.amazon.com/premiumsupport/knowledge-center/vpc-analyze-inbound-traffic-nat-gateway/ D is the case when we want to know if Traffic to the public IP was initiated from a private instance filter (dstAddr like 'public IP' and srcAddr like 'xxx.xxx')

D is correct. sb333 explained it very well.

The question already states "Action=Accept from Internet inbound to Private IP" Option 'D' fulfils that condition.

Answer is D

D. - to determine that it 's unsolicited or not.

traffic to the public IP was initiated from a private instance filter (dstAddr like 'public IP' and srcAddr like 'xxx.xxx') | stats sum(bytes) as bytesTransferred by srcAddr, dstAddr | limit 10

Agree with sb333 we need to observe egress to determine if it was solicited https://aws.amazon.com/premiumsupport/knowledge-center/vpc-analyze-inbound-traffic-nat-gateway/ by Cloudxie says "select appropriate log"