Employees connect to EC2 instances over RDP and you must count how many RDP sessions are initiated each day. Which steps (choose three) will collect metrics for daily RDP session counts?

To count daily RDP sessions, you need to capture network flow data. Creating a VPC Flow Log for the VPC is the foundational step, as it records information about IP traffic going to and from network interfaces in your VPC, including RDP (port 3389). You then need a destination for these logs, so creating a CloudWatch Logs log group and specifying it as the destination for the VPC Flow Log ensures the data is stored and accessible. Finally, to extract the specific RDP session count, you create a metric filter on that CloudWatch Logs log group. This filter can identify RDP traffic (e.g., destination port 3389) and increment a custom CloudWatch metric each time it's detected. The incorrect options are not relevant or effective for this task. EventBridge rules for instance state changes don't capture RDP session data. CloudWatch Logs subscription filters with EventBridge are for forwarding logs, not for extracting metrics from log content.