A company uses AWS Network Firewall to inspect traffic to and from the internet. They need to capture full metadata (source/destination IPs, protocol) and record all traffic flows and any DROP or ALERT actions taken by the firewall. The firewall endpoints and route tables are correctly placed so traffic flows through Network Firewall. How should the firewall be configured to meet these logging and metadata requirements?

The correct answer ensures all requirements are met. To capture full metadata and all traffic flows, Network Firewall's stateful engine is necessary because it inspects all traffic, unlike the stateless engine which only inspects the first packet of a flow. Configuring Network Firewall logging for both alert logs (for DROP/ALERT actions) and flow logs (for all traffic flows and metadata) directly addresses the logging requirements. Separately selecting destinations for these logs allows for proper storage and analysis. The first incorrect option is insufficient because it only mentions CloudWatch Logs for flow logs and doesn't explicitly configure alert logs or specify the stateful engine for full metadata. The second incorrect option is better but still doesn't explicitly state that the stateful engine should process all traffic for full metadata capture, and the separate destination selection for stateful/stateless engines is not the primary configuration for flow/alert logs. The fourth incorrect option is incorrect because VPC Flow Logs capture traffic at the ENI level, not the detailed Network Firewall events and metadata, and wouldn't include Network Firewall's DROP/ALERT actions.