A security team wants to detect a potential brute-force attack on an EC2 instance. They have VPC Flow Logs enabled and sending to CloudWatch Logs. They want to be alerted when there are more than 20 rejected inbound SSH connections from the same source IP within a 5-minute window. What is the most efficient way to implement this?

Create a CloudWatch alarm on the VPC Flow Logs metric 'RejectedConnections'.

Create a metric filter that extracts the source IP, destination port 22, and 'REJECT', then create a CloudWatch alarm with a period of 5 minutes and a threshold of 20.

Create an AWS Config rule to check for security group rules that allow SSH from many IPs.

Use CloudWatch Logs Insights to run a query every 5 minutes and trigger an SNS notification.

AWSCertified Advanced Networking - Specialty

Domain 4Objective 2

Task 4.2: Validate and Audit Security by Using Network Monitoring and Logging Services ANS-C01 Practice Questions (Page 6)

Part of the Content Domain 4: Network Security, Compliance, and Governance domain, which accounts for 24% of the ANS-C01 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~17–28 in this domain), expect 6–9 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

10concepts

24%of the exam

10 Concepts in This Objective

Network Monitoring and Logging Services Overview
VPC Flow Logs Configuration and Analysis
CloudWatch Logs for Network Security
CloudTrail for Network API Auditing
AWS Config for Network Compliance
GuardDuty for Threat Detection
Log Aggregation and Centralization
Security Auditing with Athena and QuickSight
Alarming and Notification for Security Events
Compliance Validation and Reporting

Questions 26–29

26expert · hard
A security team wants to detect a potential brute-force attack on an EC2 instance. They have VPC Flow Logs enabled and sending to CloudWatch Logs. They want to be alerted when there are more than 20 rejected inbound SSH connections from the same source IP within a 5-minute window. What is the most efficient way to implement this?
Select an answer first
27foundation · easy
A security manager wants to create a visual dashboard that shows trends in rejected traffic from VPC Flow Logs for executive reporting. Which AWS service can be used to create interactive visualizations and dashboards from the query results?
Select an answer first
28foundation · easy
A network engineer needs to enable VPC Flow Logs for a specific EC2 instance's network interface to analyze traffic to and from that instance. What is the smallest resource scope that can be selected when creating a flow log?
Select an answer first
29application · medium
A network administrator needs to audit all changes to network ACLs and security groups in their AWS account for the last 30 days. Which AWS service should they use to get a list of these changes?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to ANS-C01

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “ANS-C01” is a trademark of its owner, used for identification only.

Task 4.2: Validate and Audit Security by Using Network Monitoring and Logging Services ANS-C01 Practice Questions (Page 6)

Questions 26–29

A security manager wants to create a visual dashboard that shows trends in rejected traffic from VPC Flow Logs for executive reporting. Which AWS service can be used to create interactive visualizations and dashboards from the query results?

A network engineer needs to enable VPC Flow Logs for a specific EC2 instance's network interface to analyze traffic to and from that instance. What is the smallest resource scope that can be selected when creating a flow log?

A network administrator needs to audit all changes to network ACLs and security groups in their AWS account for the last 30 days. Which AWS service should they use to get a list of these changes?

Keep studying — Content Domain 4: Network Security, Compliance, and Governance