A company enabled VPC Flow Logs for its NAT gateway and observes Action = ACCEPT for inbound traffic from public IP 198.51.100.2 destined for a private EC2 instance. The VPC CIDR's first two octets are 203.0. The solutions architect must determine whether this represents unsolicited inbound traffic from the internet. Which steps should the architect take?
Choose an answer
Tap an option to check your answer.
Correct answer: Open the Amazon CloudWatch console, select the log group containing the NAT gateway's ENI and the private instance's ENI, run a query filtering destination as "like 203.0" and source as "like 198.51.100.2", then run stats to sum bytes transferred by source and destination..
Why this is the answer
VPC Flow Logs are published to Amazon CloudWatch Logs, not CloudTrail. CloudWatch Logs Insights is the appropriate service for querying and analyzing log data. The correct query filters for the destination IP range (the VPC CIDR, 203.0.0.0/16) and the source IP (198.51.100.2) to identify inbound traffic from that specific public IP to the private instance. The stats command with sum bytes helps quantify the traffic. The incorrect options either use CloudTrail, which is for API activity, not network flow logs, or incorrectly reverse the source and destination in the query, which would look for traffic from the private instance to the public IP, not the other way around.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed