MENU
A retail company is running its service on AWS. The company's architecture includes Application Load Balancers (ALBs) in public subnets. The ALB target groups are configured to send traffic to backend Amazon EC2 instances in private subnets. These backend EC2 instances can call externally hosted services over the internet by using a NAT gateway.
The company has noticed in its billing that NAT gateway usage has increased significantly. A network engineer needs to find out the source of this increased usage.
Which options can the network engineer use to investigate the traffic through the NAT gateway? (Choose two.)
Suggested Answer: C
Get Premium ANS-C01 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
The correct solution is to use an S3 interface endpoint and an on-premises DNS resolver. An S3 interface endpoint allows you to access Amazon S3 using private IP addresses within your VPC. An on-premises DNS resolver can be configured to forward the DNS queries for the S3 domain names to the S3 interface endpoint, so that the on-premises workloads can access Amazon S3 privately over the VPN connection. This solution is operationally efficient, as it does not require any additional infrastructure or changes to the existing workloads. The VPC workloads can continue to use the S3 gateway endpoint, which provides lower latency and higher throughput than the S3 interface endpoint.
34 comments · newest first
IR
Irene
11 months ago
Enabling logs to S3 and using Athena seems like overkill for this issue.
MI
Mila
11 months ago
I agree, using CloudWatch Logs Insights is super helpful for analysis.
AS
Asha
11 months ago
Wait, can you really use Traffic Mirroring on a NAT gateway? Sounds complicated!
CO
Cordelia
11 months ago
I think NAT gateway access logs are more straightforward.
VI
Vincenza
12 months ago
Definitely VPC flow logs are a must for this!
NA
Natalie
12 months ago
I’m pretty sure NAT gateway access logs are a thing, but I can't recall if they go to CloudWatch or S3. I guess I should consider both options B and E.
NO
Novella
1 year ago
I feel like Traffic Mirroring was mentioned in one of our practice questions, but it seems a bit complex for this scenario. I’m leaning towards the flow logs instead.
CH
Chauncey
1 year ago
I think option A sounds familiar, but I also recall something about using S3 buckets with Athena for log analysis. Maybe option E is a good choice too?
EL
Elouise
1 year ago
I remember we discussed VPC flow logs in class, but I'm not sure if they can be enabled directly on the NAT gateway itself.
LU
Luis
1 year ago
Traffic mirroring could be a good way to get a more detailed view of the traffic, but it might be overkill for this particular issue. I'd probably start with the logs first and see if I can find the root cause before resorting to more advanced techniques.
GI
Gilma
1 year ago
I think the key here is to use the right tools to analyze the logs. CloudWatch Logs Insights and Athena both sound like good options, but I'm not sure which one would be more appropriate in this case.
LU
Luis
1 year ago
I'm a bit confused about the difference between VPC flow logs and NAT gateway access logs. Do I need to enable both to get a complete picture of the traffic?
SH
Shannan
1 year ago
This seems like a straightforward question. I'd start by looking at the VPC flow logs and NAT gateway access logs to see if I can identify any patterns or anomalies in the traffic.
MI
Mitsue
1 year ago
Okay, I've got this. The capability maturity model is all about assessing process maturity, so the answer has to be B - how well a process is implemented and performing at a given level.
AR
Aracelis
1 year ago
I'm unsure about the balancing allowance versus charge—it feels like we calculated this in class but I'm blanking on the details.
LO
Louisa
1 year ago
I think the answer might be false positive since that's when legitimate traffic is mistakenly identified as a threat.
MI
Milly
1 year ago
Hmm, I think the key here is to focus on the definitions of these terms and how they contribute to making a system more resilient. I'll try to break down each option and see which ones fit best.
JO
Josefa
1 year ago
I'd go with options A and B. Simple, effective, and no need to bring in Athena or set up extra infrastructure. Let's keep it clean and efficient, folks.
SA
Sarah
1 year ago
I think focusing on those two options will help us pinpoint the source of the increased NAT gateway usage. Let's go with A and B.
TA
Tasia
1 year ago
Definitely, keeping it simple is key. Flow logs and access logs should give us the information we need.
EL
Elza
1 year ago
I agree, options A and B seem like the best choices. No need to overcomplicate things.
EV
Evangelina
1 year ago
Wait, are we sure the increased NAT gateway usage isn't because someone's been mining cryptocurrency on the backend EC2 instances? Just a thought...
DO
Doyle
1 year ago
Haha, I'm picturing the network engineer sifting through terabytes of VPC flow logs like a forensic analyst. Options D and E with Athena could work, but they sound a bit more complicated than the CloudWatch options.
OS
Osvaldo
1 year ago
True, it might be worth the extra effort for a deeper analysis.
SH
Sharika
1 year ago
But maybe using Athena could provide more detailed insights.
FL
Florinda
1 year ago
I agree, using CloudWatch Logs for analysis seems more straightforward.
MA
Makeda
1 year ago
Yeah, analyzing VPC flow logs can be quite a task.
KE
Kenneth
2 years ago
I like the idea of using Traffic Mirroring in option C, but it might be overkill for this use case. Plus, it requires setting up an additional EC2 instance, which adds complexity.
WI
Willie
1 year ago
B: I agree. Enabling NAT gateway access logs in option B could also help in investigating the increased usage.
GL
Glory
1 year ago
A: I think option A is a good choice. Flow logs in CloudWatch can provide valuable insights.
MA
Makeda
2 years ago
I personally prefer option D and E. Using Athena to query and analyze the logs seems more efficient to me.
AL
Alita
2 years ago
Options A and B seem like the most straightforward way to investigate the NAT gateway usage. Enabling the logs and using CloudWatch Insights is a pretty simple solution.
SV
Svetlana
2 years ago
I agree with you, Evan. Enabling VPC flow logs and NAT gateway access logs will provide valuable insights.
EV
Evan
2 years ago
I think option A and B are the best choices to investigate the NAT gateway usage.