ANS-C01 Exam Dumps : Amazon AWS Certified Advanced Networking - Specialty

This solution involves using Amazon GuardDuty to monitor network traffic and analyze DNS requests and VPC flow logs for suspicious activity. This will allow the company to identify when an application is spreading malware by monitoring the network traffic patterns associated with the instance. GuardDuty is a fully managed threat detection service that continuously monitors for malicious activity and unauthorized behavior in your AWS accounts and workloads. It requires minimal setup and configuration and can be integrated with other AWS services for automated remediation. This solution requires the least operational effort compared to the other options

Private VIF on Direct Connect: A private virtual interface (VIF) is used to establish a private connection between your data center and your VPC over AWS Direct Connect. This allows traffic to remain within the private network.

Amazon S3 Gateway Endpoint: A gateway endpoint provides a scalable and highly available way to privately access Amazon S3 without requiring an internet gateway or NAT gateway. Gateway endpoints are more cost-effective than interface endpoints for accessing S3, especially for high-volume data transfers like application logs.

Source IP Addresses in Dropped Traffic: When traffic is dropped by the transit gateway, the source IP addresses are the origin of the traffic causing the issue. To block this traffic from entering the VPC, an inbound rule must be added to the network ACL for the transit gateway attachment subnets.

Inbound Rule on Network ACL: Network ACLs (NACLs) are stateless and require explicit rules to allow or deny traffic. Adding aninbound ruleto deny traffic from the source IP addresses effectively prevents the unwanted traffic from entering the VPC.

Notification Details: The existing Lambda function should include the source IP addresses in the SNS notification so that the new Lambda function can use this information to automatically update the NACL.