SAA-C03 Practice Question 71: VPC Flow Logs Blocked Traffic
AWS Certified Solutions Architect – Associate (SAA-C03) · Test 8 · question 1 of 10
An application instance in a private subnet cannot reach an internal API on another instance, and the two teams disagree about whether a security group, a network ACL or the application itself is at fault. The network team needs a record of which connection attempts are being accepted and which are being rejected at the network interfaces, and wants it without touching the instances or affecting throughput.
What should they enable?
Show answer and explanation
Answer:
VPC Flow Logs capture information about the IP traffic going to and from network interfaces in a VPC, and AWS names diagnosing overly restrictive security group rules and determining the direction of traffic as two of the tasks the feature exists for. Records can be published to CloudWatch Logs, S3 or Data Firehose. Crucially for this scenario, flow log data is collected outside the path of the network traffic, so enabling it does not affect throughput or latency and nothing is installed on the instances.
Option A records API calls made to AWS services. CloudTrail would show someone modifying a security group; it never shows a packet between two instances, because that traffic is not an AWS API call.
Option C would work but is far heavier than the question calls for. Traffic Mirroring copies the actual packets to an appliance you must run and pay for, which is the tool for deep packet inspection rather than for answering "was this connection allowed or denied".
Option D increases the frequency of instance metrics such as CPU and network bytes to one minute. Aggregate counters cannot tell you which specific connection attempt was rejected or by what.
Reference: Logging IP traffic using VPC Flow Logs