ANS-C01 Exam Dumps : Amazon AWS Certified Advanced Networking - Specialty

MACsec for Direct Connect:

MACsec (Media Access Control Security) is an IEEE standard (802.1AE) for encrypting traffic at Layer 2. AWS Direct Connect supports MACsec on dedicated connections of 10 Gbps and 100 Gbps capacity. This ensures that all WAN traffic over the Direct Connect connection is encrypted, meeting regulatory requirements.

Does Not Affect Bandwidth:

MACsec operates at the physical layer (Layer 2), and its encryption overhead is negligible. This ensures that the company's bandwidth capacity is not affected.

Existing Direct Connect Connection:

Configuring MACsec on the port of the existing Direct Connect connection avoids the need to establish a new connection, reducing complexity and costs.

To distribute traffic from customers to EC2 instances in an Auto Scaling group and encrypt all traffic at all stages between the customers and the application servers without decryption at intermediate points, the company should create a Network Load Balancer (NLB) with a TCP listener and configure the Auto Scaling group to register instances with the NLB’s target group (Option C). This solution allows for end-to-end encryption of trafficwithout decryption at intermediate points.

This solution involves using Amazon GuardDuty to monitor network traffic and analyze DNS requests and VPC flow logs for suspicious activity. This will allow the company to identify when an application is spreading malware by monitoring the network traffic patterns associated with the instance. GuardDuty is a fully managed threat detection service that continuously monitors for malicious activity and unauthorized behavior in your AWS accounts and workloads. It requires minimal setup and configuration and can be integrated with other AWS services for automated remediation. This solution requires the least operational effort compared to the other options