ANS-C01 practice question 23 of 35

A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application Load Balancer. The application must always be…

Full set: 291 questions
A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application Load Balancer. The application must always be reachable on port 443 from the public internet. The application recently had an outage that resulted from an incorrect change to the EC2 security group. A network engineer needs to automate a way to verify the network connectivity between the public internet and the EC2 instances whenever a change is made to the security group. The solution also must notify the network engineer when the change affects the connection. Which solution will meet these requirements?
Answer options
A: Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture REJECT traffic on port 443. Publish the flow log records to a log group in Amazon CloudWatch Logs. Create a CloudWatch Logs metric filter for the log group for rejected traffic. Create an alarm to notify the network engineer.
B: Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture all traffic on port 443. Publish the flow log records to a log group in Amazon CloudWatch Logs. Create a CloudWatch Logs metric filter for the log group for all traffic. Create an alarm to notify the network engineer
C: Create a VPC Reachability Analyzer path on port 443. Specify the security group as the source. Specify the EC2 instances as the destination. Create an Amazon Simple Notification Service (Amazon SNS) topic to notify the network engineer when a change to the security group affects the connection. Create an AWS Lambda function to start Reachability Analyzer and to publish a message to the SNS topic in case the analyses fail Create an Amazon EventBridge (Amazon CloudWatch Events) rule to invoke the Lambda function when a change to the security group occurs.
D: Create a VPC Reachability Analyzer path on port 443. Specify the internet gateway of the VPC as the source. Specify the EC2 instances as the destination. Create an Amazon Simple Notification Service (Amazon SNS) topic to notify the network engineer when a change to the security group affects the connection. Create an AWS Lambda function to start Reachability Analyzer and to publish a message to the SNS topic in case the analyses fail. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to invoke the Lambda function when a change to the security group occurs. Correct answer
Correct Answer:
D. Create a VPC Reachability Analyzer path on port 443. Specify the internet gateway of the VPC as the source. Specify the EC2 instances as the destination. Create an Amazon Simple Notification Service (Amazon SNS) topic to notify the network engineer when a change to the security group affects the connection. Create an AWS Lambda function to start Reachability Analyzer and to publish a message to the SNS topic in case the analyses fail. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to invoke the Lambda function when a change to the security group occurs.
Explanation

This solution provides a proactive and automated way to verify network connectivity. VPC Reachability Analyzer is designed to analyze the network path between a source and a destination. By specifying the internet gateway as the source and the EC2 instances as the destination, it accurately simulates traffic from the public internet. Using an Amazon EventBridge rule to trigger an AWS Lambda function upon a security group change automates the verification process. The Lambda function initiates the analysis and uses Amazon SNS to notify the engineer if the path becomes unreachable, directly addressing the requirements.

Why Incorrect

A. VPC Flow Logs are reactive, capturing data about traffic that has already been accepted or rejected. They do not proactively test the connectivity path after a configuration change.
B. This is also reactive. Capturing all traffic does not verify that a path is open if no traffic is currently flowing, and it doesn't proactively test the path after a change.
C. Specifying a security group as the source for Reachability Analyzer is incorrect. A security group is a stateful firewall, not a network component that can be a source of traffic.

References

1. AWS Documentation, VPC User Guide, "Reachability Analyzer". It states, "You can use Reachability Analyzer to trace and analyze the network path between a source resource and a destination resource in your virtual private clouds (VPCs)."

2. AWS Documentation, VPC User Guide, "Use cases for Reachability Analyzer". It lists "Troubleshoot connectivity issues" and confirms that an internet gateway can be a source and a network interface can be a destination.

3. AWS Documentation, Amazon EventBridge User Guide, "Events from AWS services". This document confirms that API calls, such as those that modify security groups, generate events that can be used as triggers for rules.

4. AWS Documentation, VPC User Guide, "Reachability Analyzer supported resources". This table explicitly lists "Internet gateways" as a supported source type.

Keep practicing

Take the free ANS-C01 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other ANS-C01 practice questions

Scroll to Top