AWS Certified SysOps Administrator – AssociateMonitoring, Logging, and RemediationHard
A SysOps administrator is investigating a sudden spike in network traffic from an application's EC2 instances to an unknown external IP address. They need to quickly identify the source process on the EC2 instances responsible for this outbound traffic without logging into each instance manually. The solution should work across multiple instances. Which AWS service can help achieve this?
- AAWS Systems Manager Run Command
- BAmazon GuardDuty
- CAmazon VPC Flow Logs
- DAWS CloudTrail
Show answer & explanationAnswer & explanation
Correct answer: A. AWS Systems Manager Run Command
AWS Systems Manager Run Command allows you to remotely and securely manage the configuration of your instances. You can use Run Command to execute shell commands or PowerShell scripts on multiple EC2 instances simultaneously (e.g., `netstat -tulnp` or `lsof -i`) and retrieve the output to identify the process responsible for network connections, all without direct SSH access.
Why the other options are wrong
- B. GuardDuty detects malicious activity and unusual behavior, which might *alert* to the traffic, but it won't directly tell you the specific process ID (PID) on the EC2 instance causing it.
- C. VPC Flow Logs record traffic metadata (source/destination IP, port, protocol), but they don't identify the *process* on the instance generating the traffic.
- D. CloudTrail logs API calls made to AWS, not internal network traffic or processes running on EC2 instances.
Systems Manager Run Command for Diagnostics
AWS Systems Manager Run Command enables you to remotely and securely execute commands on your EC2 instances (and on-premises servers) at scale, without needing to SSH or RDP into them, making it ideal for diagnostics and troubleshooting.
- Execute commands on instances remotely.
- Works at scale across multiple instances.
- No SSH/RDP required.
- Useful for diagnostics, patching, configuration.
Memory trick: Run Command 'runs' a check to find the 'commanding' process.