Investigate incoming traffic to a VM in the default VPC suspected of a DoS attack. How do you capture source IP addresses for analysis?

Enabling VPC Flow Logs for the subnet is the correct approach because Flow Logs capture metadata about IP traffic flowing through network interfaces, including source IP addresses. This data is essential for identifying the origin of a DoS attack. The connection field within Flow Logs specifically contains details like source and destination IP addresses, ports, and protocols. Enabling Data Access audit logs is incorrect because these logs record administrative activities and data access events, not network traffic flow details. While they might show who accessed a resource, they won't provide the source IPs of incoming network connections to a VM. Enabling Flow Logs for the entire VPC is less granular and might generate excessive logs if only a specific subnet is affected. The srclocation field is not a standard field for source IP in VPC Flow Logs; the connection field is.