CLF-C02 Practice Question 86: Network Traffic Logging
AWS Certified Cloud Practitioner (CLF-C02) · Test 9 · question 6 of 10
An application on an Amazon EC2 instance is not receiving connections from its clients, and an engineer suspects that a security group rule is too restrictive. The engineer wants a record of the IP traffic going to and from the instance's network interface, without installing packet-capture software or affecting network performance. What should the engineer use?
Show answer and explanation
Answer:
VPC Flow Logs capture information about the IP traffic going to and from network interfaces in a VPC and publish it to Amazon CloudWatch Logs, Amazon S3 or Amazon Data Firehose. AWS lists diagnosing overly restrictive security group rules and monitoring the traffic that reaches an instance among their uses. Flow log data is collected outside the path of the network traffic, so it does not affect network throughput or latency.
Option A, CloudTrail, records *API calls* made in the account, such as who changed a security group. It does not record the network traffic that reaches an instance. Option C, AWS Config, records resource *configurations* and how they change over time, so it can show the current security group rules but not the traffic that was accepted or rejected. Option D, Amazon Inspector, scans workloads for software vulnerabilities and unintended network exposure. It does not log live traffic.
Reference: Logging IP traffic using VPC Flow Logs