ANS-C01 Free Practice Test

A company’s network engineer needs to design a new solution to help troubleshoot and detect network anomalies. The network engineer has configured Traffic Mirroring. However, the mirrored traffic is overwhelming the Amazon EC2 instance that is the traffic mirror target. The EC2 instance hosts tools that the company’s security team uses to analyze the traffic. The network engineer needs to design a highly available solution that can scale to meet the demand of the mirrored traffic.
Which solution will meet these requirements?

1. A. Deploy a Network Load Balancer (NLB) as the traffic mirror targe
2. B. Behind the NL
3. C. deploy a fleet of EC2 instances in an Auto Scaling grou
4. D. Use Traffic Mirroring as necessary.
5. E. Deploy an Application Load Balancer (ALB) as the traffic mirror targe
6. F. Behind the ALB, deploy a fleet of EC2 instances in an Auto Scaling grou
7. G. Use Traffic Mirroring only during non-business hours.
8. H. Deploy a Gateway Load Balancer (GLB) as the traffic mirror targe
9. I. Behind the GL
10. J. deploy a fleet of EC2 instances in an Auto Scaling grou
11. K. Use Traffic Mirroring as necessary.
12. L. Deploy an Application Load Balancer (ALB) with an HTTPS listener as the traffic mirror targe
13. M. Behind the AL
14. N. deploy a fleet of EC2 instances in an Auto Scaling grou
15. O. Use Traffic Mirroring only during active events or business hours.

Correct Answer: A

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.
The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.
Which solution will meet these requirements with the LEAST operational overhead?

1. A. Create VPC flow logs in the default forma
2. B. Create a filter to gather flow logs only from the EKS nodes.Include the srcaddr field and the dstaddr field in the flow logs.
3. C. Create VPC flow logs in a custom forma
4. D. Set the EKS nodes as the resource Include the pkt-srcaddr field and the pkt-dstaddr field in the flow logs.
5. E. Create VPC flow logs in a custom forma
6. F. Set the application subnets as resource
7. G. Include the pkt-srcaddr field and the pkt-dstaddr field in the flow logs.
8. H. Create VPC flow logs in a custom forma
9. I. Create a filter to gather flow logs only from the EKS nodes.Include the pkt-srcaddr field and the pkt-dstaddr field in the flow logs.

Correct Answer: D