An app intermittently loses connectivity to a partner API. Ops suspects a stateless rule is dropping return traffic. Which log record would confirm a blocked connection attempt?
A.CloudTrail events for the API call
CloudTrail logs control-plane API calls, not packet flows.
B.VPC Flow Log entries showing REJECT on the ENI
Correct. REJECT records show exactly what's dropped and where.
C.CloudWatch CPUUtilization metrics
CPU metrics say nothing about packet filtering.
D.Route 53 query logs
DNS logs cover name resolution, not traffic blocking.
Why this answer
VPC Flow Logs record ACCEPT/REJECT per flow on each ENI — a REJECT entry on the return direction pinpoints a NACL or security group blocking traffic. They're the first tool for 'is the packet even getting through.'
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Operations practice session.
Practice Network Operations