Enabling VPC (or equivalent) flow logs is the native, zero-agent way to capture metadata about every network conversation, source/destination IPs, ports, protocols, bytes transferred, across both hosts and managed appliances in your virtual network. It requires minimal setup (just a checkbox or API call) and scales automatically with your VPC.

Comprehensive and Detailed Explanation From Exact Extract:
"Identity as the perimeter" is a core principle of Zero Trust Architecture (ZTA). Rather than relying on traditional network-based perimeters, access is granted based on user identity and device posture. This is essential for remote users accessing cloud workloads, ensuring secure authentication regardless of physical location.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Zero Trust and Identity- Centric Security":
"Zero Trust shifts the trust boundary from the network to the user and device identity. 'Identity as the perimeter' ensures only verified users and devices are granted access to resources." Other options:
* A. Secure service edge (SSE) is a broad cloud security model, but not a specific ZTA principle.
* B. CASBs monitor cloud app usage, not core access authentication.
* C. Principle of least privilege is a supporting concept, but not the primary perimeter defense mechanism.

Comprehensive and Detailed Explanation From Exact Extract:
Data Loss Prevention (DLP) solutions scan messages and file transfers for sensitive data patterns, such as credit card numbers or social security numbers. DLP can block, log, or alert when such information is detected attempting to leave the organization.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Data Protection and Compliance Controls":
"DLP systems identify and restrict the transmission of sensitive data such as credit card numbers, enforcing organizational data handling policies." Other options:
* A. IDS detects threats but doesn't enforce data content policies.
* B. Egress filtering restricts destinations but not content.
* D. Encryption protects data in transit, not its content compliance.

Comprehensive and Detailed Explanation From Exact Extract:
A CMDB (Configuration Management Database) is a centralized repository used to store information about IT assets and their relationships, including configuration items such as servers, applications, and databases. It provides visibility into dependencies between infrastructure components, including application and database tiers. This is essential for cloud migration and modernization projects where understanding interdependencies ensures accurate planning and reduces risks.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under the "Infrastructure Documentation and Planning" domain:
"CMDBs are used to track asset relationships, allowing network and systems engineers to visualize and manage dependencies between services, applications, and infrastructure components critical for change management and cloud migration." Other options:
* A. Internal knowledge base articles may offer general guidance but not structured dependency mapping.
* C. WBS (Work Breakdown Structure) outlines tasks and deliverables, not technical dependencies.
* D. Physical server diagrams are not relevant in virtualized/cloud environments.
* E. SOW (Statement of Work) defines project scope but lacks infrastructure-level detail.

The -A flag enables aggressive scanning, which combines OS detection, version detection, script scanning, and traceroute to give you detailed information on hosts in the 10.10.10.0/28 range.