ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Using VPC Traffic Mirroring lets the engineer copy packets from the elastic network interfaces of the application servers to a dedicated IDS appliance located in a separate monitoring subnet. Because the IDS receives mirrored copies of the traffic rather than sitting in the forwarding path, the solution operates in a passive mode, meeting the inspection mandate without introducing latency or becoming a single point of failure. Routing traffic through a stateful inline device (such as an AWS Network Firewall) or a self-managed proxy would meet the inspection goal but would also place the device in the data path, increasing complexity and potential bottlenecks. Security groups alone cannot provide deep-packet inspection, and gateway endpoints cannot be repurposed as IDS appliances. Therefore, leveraging VPC Traffic Mirroring with an out-of-band IDS instance is the most effective solution.