A third-party pricing service communicates with EC2 instances over UDP port 50000. Responses sometimes appear malformed. The vendor wants to capture request and response data for debugging by accessing an EC2 instance that talks to the pricing service, but the company forbids direct access to production and requires analysis in a separate monitoring account. Which sequence of actions meets these constraints and captures the data?

The correct option uses Traffic Mirroring, which allows you to copy network traffic from an ENI and send it to a monitoring tool. This is ideal for deep packet inspection and debugging. By sending the mirrored traffic to an EC2 instance in a separate monitoring account, it adheres to the company's security policy of no direct access to production and analysis in a separate account. VPC Flow Logs (option 1) only record metadata about IP traffic (source, destination, port, protocol, action), not the actual packet contents, so they cannot be used for debugging malformed responses. Option 2 is incorrect because it places the packet inspection tool in the production account, violating the company's requirement for analysis in a separate monitoring account. Option 4 involves direct access to the production instance to run tcpdump, which is explicitly forbidden by company policy.