A company must send all network traffic to and from its EC2 instances to a centralized third-party EC2 appliance for content inspection to meet a new regulation. Which design satisfies this requirement?
Choose an answer
Tap an option to check your answer.
Correct answer: Create a third-party EC2 appliance in an Auto Scaling group fronted by a Network Load Balancer (NLB). Configure a mirror session. Specify the NLB as the mirror target. Specify a mirror filter to capture inbound and outbound traffic. For the source of the mirror session, specify the EC2 elastic network interfaces for all the instances that host the application..
Why this is the answer
The correct solution uses traffic mirroring, which allows you to copy network traffic from an EC2 instance's Elastic Network Interface (ENI) and send it to a monitoring appliance for inspection. By specifying the NLB as the mirror target, all mirrored traffic is directed to the third-party EC2 appliance, which is in an Auto Scaling group for high availability and scalability. A mirror filter ensures both inbound and outbound traffic are captured. Incorrect options: VPC Flow Logs only capture metadata about IP traffic; they do not capture the actual content of the packets, which is required for content inspection. Kinesis Data Firehose is designed for streaming data, not for real-time content inspection of live network traffic, and it doesn't natively support receiving mirrored traffic for this purpose. Similar to the first incorrect option, VPC Flow Logs sent to CloudWatch also only provide metadata, not the packet content needed for deep content inspection.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed