A security team is performing an audit of a company's AWS deployment. The security team is concerned that two

Question

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing
Resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes
Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate
Subnets within the same VPC and have a Cluster Autoscaler con¦gured.
The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team
Wants to limit the number of §ow logs and wants to examine the tra¨c from only the two applications.
Which solution will meet these requirements with the LEAST operational overhead?

Accepted Answer

D. Create VPC §ow logs in a custom format. Create a ¦lter to gather §ow logs only from the EKS nodes. Include the pkt-srcaddr ¦eld and the Pkt-dstaddr ¦eld in the §ow logs.

Answer

A. Create VPC §ow logs in the default format. Create a ¦lter to gather §ow logs only from the EKS nodes. Include the srcaddr ¦eld and the Dstaddr ¦eld in the §ow logs.

Answer

B. Create VPC §ow logs in a custom format. Set the EKS nodes as the resource Include the pkt-srcaddr ¦eld and the pkt-dstaddr ¦eld in the §ow logs.

Answer

C. Create VPC §ow logs in a custom format. Set the application subnets as resources. Include the pkt-srcaddr ¦eld and the pkt-dstaddr ¦eld in The §ow logs.

Q52 — AWS ANS-C01 Ch.1

Correct Answer: D. Create VPC §ow logs in a custom format. Create a ¦lter to gather §ow logs only from the EKS nodes. Include the pkt-srcaddr ¦eld and the Pkt-dstaddr ¦eld in the §ow logs.

Explanation