VPC Flow Logs/AWS Logging Services

Question 1

What type of traffic does vpc flow logs capture?

Answer 1

Only packet metadata.

Question 2

What is the protocol number for ICMP?

Answer 2

1

Question 3

What is the protocol number for TCP?

Answer 3

6

Question 4

What is the protocol number for UDP?

Answer 4

17

Question 5

Where do flow log data get stored?

Answer 5

Either Cloudwatch logs, S3 bucket, or Kinesis Firehose.

Question 6

What are 9 types of traffic that are not logged by flow log?

Answer 6

AWS server traffic
AWS windows license activations
Instance metadata to 169.254.169.254
Time sync traffic to 169.254.169.123
DHCP traffic
Traffic from mirrored interfaces
VPC default gateway reserved IP address traffic
Traffic endpoint interfaces
Network load balancer

Question 7

If you delete a flow log, is that data retained?

Answer 7

Yes

Question 8

Where can flow logs be created?

Answer 8

Elastic load balancer
Amazon relational database (RDS)
Redshift
Workspaces
Nat gateways
Transit gateways

Question 9

What are some use cases for flow logs?

Answer 9

Monitoring traffic sent/received from an EC2 instance
Analyzing traffic flows inside your VPC
Troubleshooting security group restrictions
*This list is not exclusive.

Question 10

Is flow logs a real-time service?

Answer 10

No

Question 11

When using flow logs, what are the two things AWS will charge you for?

Answer 11

1) Ingestion of data
2) Storage of the logs

Question 12

What is Baseline service?

Answer 12

Data collected from monitoring metrics and logs are used to understand usage over time and to create a performance baseling.

Question 13

What is Config service?

Answer 13

An AWS configuration tracking service. It records and stores a detailed record of how your services are configured. It is also considered a change management tool for tracking changes.

Question 14

What is Application Insights service?

Answer 14

AWS managed service that can automatically perform discovery on resources and workloads that it supports. It helps identify issues and resolve problems with applications, databases, and workloads.

Question 15

What is Inspector services?

Answer 15

AWS managed service that performs security/vulnerability analysis and assessments for EC2 and ECR container instances, applications, network accessibility, and how security is configured for the application instances.

Question 16

For flow logs, what three levels can a monitor attach to?

Answer 16

1) VPC level (all ENIs)
2) Subnet level (all ENIs in that subnet)
3) Individual ENIs

Question 17

Can flow logs be configured to go to different destinations? If so, where?

Answer 17

Yes, S3 buckets, cloudwatch, and Kinesis Firehose.

Question 18

What are the advantages to sending flow log data to an S3 bucket?

Question 19

What are the advantages to sending flow log data to cloudwatch?

Question 20

What is contained within a flow log record?

Answer 20

There are many fields, but the most import is source ip, destination ip, source port, destination port, protocol, and action.
Action examples are accept or reject.

Question 21

What are the time intervals that flow log data are aggregated?

Answer 21

In 1 min intervals or 10 min intervals

Question 22

What layers of the OSI model do flow logs operate?

Answer 22

Layer 3 - ip
Layer 4 - protocol