QuestionQ57

Network Management and Operation

A company has been using an obsolete application-layer protocol for communication between applications. The company has decided to stop using this protocol and must migrate every application to support a new protocol. Both the old and new protocols are TCP-based, but they use different port numbers.

After several months of work, the company has migrated dozens of applications that run on Amazon EC2 instances and in containers. The company believes that every application has been migrated, but wants to validate that belief. A network engineer must verify that no application is still using the old protocol.

Which solution meets these requirements without causing downtime?

  • A Use Amazon Inspector and its Network Reachability rules package. Wait until the analysis has finished running to find out which EC2 instances are still listening to the old port.
  • B Enable Amazon GuardDuty. Use the graphical visualizations to filter for traffic that uses the port of the old protocol. Exclude all internet traffic to filter out occasions when the same port is used as an ephemeral port.
  • C Configure VPC flow logs to be delivered into an Amazon S3 bucket. Use Amazon Athena to query the data and to filter for the port number that is used by the old protocol.
  • D Inspect all security groups that are assigned to the EC2 instances that host the applications. Remove the port of the old protocol if that port is in the list of allowed ports. Verify that the applications are operating properly after the port is removed from the security groups.
Explanation

Amazon VPC Flow Logs capture IP traffic to and from VPC network interfaces and include source port, destination port, and protocol information. Flow logs delivered to Amazon S3 can be queried with Amazon Athena for TCP flows using the old protocol’s port, providing traffic-based verification without changing application connectivity.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!