A company needs to analyze TCP traffic destined for the internet that originates from EC2 instances in a VPC using a NAT gateway. They must collect source and destination IPs, ports, and the first 8 bytes of TCP payload, and then store and analyze all the data. Which solution meets these requirements?
Choose an answer
Tap an option to check your answer.
Correct answer: Configure the EC2 instances as VPC traffic mirror sources. Deploy software on the traffic mirror target to forward the captured data to Amazon CloudWatch Logs. Analyze the captured traffic using CloudWatch Logs Insights..
Why this is the answer
The correct solution leverages VPC Traffic Mirroring, which allows capturing the actual network packet content, including the first 8 bytes of the TCP payload, directly from the EC2 instances. Directing this mirrored traffic to a target with software to forward it to CloudWatch Logs enables storage and analysis using CloudWatch Logs Insights. Incorrect options: Configuring the NAT gateway as a traffic mirror source is not possible; only ENIs can be sources. VPC Flow Logs (default or custom format) only record metadata about IP traffic (source/destination IP, port, protocol, bytes, packets, action), not the actual packet payload. Therefore, they cannot capture the first 8 bytes of the TCP payload.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed