A company has deployed a critical application on a §eet of Amazon EC2 instances behind an Application Load Bal

Question

A company has deployed a critical application on a §eet of Amazon EC2 instances behind an Application Load Balancer. The application must
Always be reachable on port 443 from the public internet. The application recently had an outage that resulted from an incorrect change to the
EC2 security group.
A network engineer needs to automate a way to verify the network connectivity between the public internet and the EC2 instances whenever a
Change is made to the security group. The solution also must notify the network engineer when the change affects the connection.
Which solution will meet these requirements?

Accepted Answer

D. Create a VPC Reachability Analyzer path on port 443. Specify the internet gateway of the VPC as the source. Specify the EC2 instances as The destination. Create an Amazon Simple Noti¦cation Service (Amazon SNS) topic to notify the network engineer when a change to the Security group affects the connection. Create an AWS Lambda function to start Reachability Analyzer and to publish a message to the SNS Topic in case the analyses fail. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to invoke the Lambda function when a Change to the security group occurs.

Answer

A. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture REJECT tra¨c on port 443. Publish the §ow log Records to a log group in Amazon CloudWatch Logs. Create a CloudWatch Logs metric ¦lter for the log group for rejected tra¨c. Create an Alarm to notify the network engineer.

Answer

B. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture all tra¨c on port 443. Publish the §ow log records To a log group in Amazon CloudWatch Logs. Create a CloudWatch Logs metric ¦lter for the log group for all tra¨c. Create an alarm to notify The network engineer

Answer

C. Create a VPC Reachability Analyzer path on port 443. Specify the security group as the source. Specify the EC2 instances as the Destination. Create an Amazon Simple Noti¦cation Service (Amazon SNS) topic to notify the network engineer when a change to the security Group affects the connection. Create an AWS Lambda function to start Reachability Analyzer and to publish a message to the SNS topic in Case the analyses fail Create an Amazon EventBridge (Amazon CloudWatch Events) rule to invoke the Lambda function when a change to the Security group occurs.

Q94 — AWS ANS-C01 Ch.1

Explanation