SCS-C02 Exam Dumps : AWS Certified Security - Specialty

The correct answer is A because it allows the security engineer to add the X-Frame-Options header to the HTTPS responses from the application origin without modifying the origin itself. A Lambda@Edge function is a Lambda function that runs in response to CloudFront events, such as viewer request, origin request, origin response, or viewer response. By configuring the function to runin response to the origin response event, the security engineer can modify the response headers that CloudFront receives from the origin before sending them to the viewer1. The function can include code to add the X-Frame-Options header with the desired value, suchas DENY or SAMEORIGIN, to prevent frame-related cross-site scripting attacks2.

The other options are incorrect because they are either less efficient or less secure than option A. Option B is incorrect because configuring the Lambda@Edge function to run in response to the viewer request event is not optimal, as it adds latency to the request processing and does not modify the response headers that CloudFront receives from the origin. Option C is incorrect because adding X-Frame-Options to custom headers in the origin settings does not affect the response headers that CloudFront sends to the viewer. Custom headers are only used to send additional information to the origin when CloudFront forwards a request3. Option D is incorrect because customizing the EC2 hosted application to add the X-Frame-Options header to the responses requires changing the origin code, which may not be feasible or desirable for the security engineer.

Enable VPC Flow Logs:

VPC flow logs capture details about the network traffic in your VPC, including both accepted and rejected traffic.

Configure the flow logs to capture traffic for the subnet where the affected EC2 instances are located.

Filter Rejected Traffic:

In the flow log configuration, ensure that you capture rejected traffic (log-status = REJECT).

This will provide a record of instances that attempted to communicate on TCP port 2905 and were blocked by the NACL rule.

Analyze Flow Logs:

Search the flow log records for entries where:

destination-port = 2905

log-status = REJECT

This will help identify the specific EC2 instances attempting to communicate on TCP port 2905.

Advantages of Using VPC Flow Logs:

Cost-effective: No additional infrastructure or services are required.

Scalable: Automatically captures traffic across the subnet without manual intervention.

Detailed Logs: Provides granular details about the rejected traffic.

VPC Flow Logs Documentation

Filtering VPC Flow Logs