Task 3.2: Monitor and Analyze Network Traffic to Troubleshoot and Optimize Connectivity Patterns ANS-C01 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a required component when setting up VPC Traffic Mirroring?

   • AA VPC peering connection
   • BA mirror target, such as a Network Load Balancer or an ENI
   • CA NAT gateway
   • DAn internet gateway
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A network engineer wants to be notified when the number of packets dropped by a NAT gateway exceeds a threshold. Which AWS service should be used to set up this notification?

   • AAWS Trusted Advisor
   • BAmazon Simple Notification Service (SNS) alone
   • CAWS Config rules
   • DAmazon CloudWatch Alarms
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company has a VPC with multiple subnets. They have enabled VPC Flow Logs and are sending them to CloudWatch Logs. The security team wants to detect potential port scanning activity. They notice that the flow logs contain many records with the 'tcp-flags' field set to 'SYN' and the 'action' field set to 'ACCEPT' for a single source IP, but the 'packets' field is always 1. They also see that the destination ports are sequential. Which analysis is most appropriate to confirm the port scan?

   • ACheck the CloudWatch metrics for the source IP to see if the network utilization is high.
   • BCreate a CloudWatch alarm on the number of flow log records for the source IP.
   • CLook for corresponding 'SYN-ACK' or 'RST' records in the flow logs to see if the destination responded.
   • DEnable Traffic Mirroring on the source instance to capture the packets and analyze the payload.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company runs a multi-tier application with a web tier and a database tier in the same VPC. The application team notices that the database tier is experiencing high latency. You analyze VPC Flow Logs and see that the database instance is receiving a large amount of traffic from a single web instance. You also notice that the web instance's network utilization is consistently high. Which action is most likely to reduce latency for the database tier?

   • AMove the database to a different subnet to reduce network hops.
   • BIncrease the size of the database instance to handle more connections.
   • CEnable Traffic Mirroring on the database instance to analyze the traffic.
   • DAdd a second web instance and distribute traffic between the two web instances.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of VPC Traffic Mirroring?

   • ATo filter malicious traffic before it reaches an instance
   • BTo encrypt traffic between VPCs
   • CTo capture and analyze network traffic for troubleshooting and security analysis
   • DTo route traffic to a different subnet
   Reveal Solution Discussion Select an answer first