easyMultiple Choice
CCSP Practice Question: Migrating its on-premises workloads to a public…
A company is migrating its on-premises workloads to a public cloud environment. The security team is concerned about maintaining visibility into network traffic between virtual machines in the same virtual network. Which cloud architecture component should be implemented to address this concern?
⚠ Common exam trap
Candidates often confuse security groups or NACLs with visibility tools, mistakenly believing that filtering or logging features (like flow logs) provide the same packet-level capture as traffic mirroring, when in fact flow logs only record metadata (e.g., source/destination IP, port, protocol) and not the full packet payload.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Virtual network traffic mirroring
Virtual network traffic mirroring (or port mirroring) enables the capture and inspection of all network packets flowing between virtual machines within the same virtual network, including east-west traffic. This provides the security team with the deep packet visibility needed for threat detection, compliance auditing, and troubleshooting without requiring changes to the VM configurations or routing paths.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Security groups
Why it's wrong here
Security groups are stateful packet filters that permit or deny traffic; they do not capture, log or mirror flows between virtual machines, so east-west visibility is absent. They are tempting because they enforce least-privilege segmentation, and would be the right choice when the requirement is to restrict which ports and sources may reach an instance.
- ✓
Virtual network traffic mirroring
Why this is correct
Virtual network traffic mirroring copies packets from virtual machine network interfaces to an analysis destination, restoring the east-west visibility that physical taps provided on-premises. Security teams can then inspect intra-virtual-network traffic that flow logs alone cannot capture at packet level.
- ✗
Virtual private cloud (VPC) peering
Why it's wrong here
VPC peering connects two virtual networks so traffic routes privately between them; it provides no inspection or logging of intra-VPC flows, which is the stated concern. It is tempting because peering is the correct choice when the requirement is to join separate VPCs, such as linking a shared-services network to a workload network.
- ✗
Network access control lists (NACLs)
Why it's wrong here
NACLs are stateless subnet-level allow/deny filters evaluated per packet; they neither log nor mirror traffic between virtual machines, so they cannot deliver the required visibility. They are tempting because NACLs are the right choice when the requirement is to block specific CIDR ranges or ports at the subnet boundary.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.