AWS Certified Advanced Networking – Specialty (ANS-C01)Network Management and OperationsEasy
A network engineer wants to monitor the flow of traffic between EC2 instances in different subnets within a VPC and detect anomalies. The solution must be cost-effective and provide detailed insights into IP traffic. Which AWS service should the engineer use?
- AAmazon Kinesis Data Firehose
- BAmazon CloudWatch Logs
- CVPC Flow Logs
- DAWS CloudTrail
Show answer & explanationAnswer & explanation
Correct answer: C. VPC Flow Logs
VPC Flow Logs capture detailed information about IP traffic going to and from network interfaces in a VPC. This service is specifically designed for monitoring network traffic and detecting anomalies.
Why the other options are wrong
- A. Kinesis Data Firehose is a delivery service for streaming data, which could be used to ingest flow logs, but it doesn't generate them.
- B. CloudWatch Logs is a log aggregation service that can store and monitor logs, but it doesn't generate flow logs itself.
- D. CloudTrail records API calls and events related to AWS services, not IP traffic flow within a VPC.
VPC Flow Logs
A feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC.
- Records source/destination IP, port, protocol, and action.
- Can be published to Amazon S3, Amazon CloudWatch Logs, or Amazon Kinesis Data Firehose.
- Useful for network troubleshooting, security analysis, and compliance.
Memory trick: Flow Logs show the 'flow' of network 'traffic' in your VPC.