A forensic investigation needs FULL packet payloads from a suspect instance — not just metadata (IP, port, bytes). Flow logs don't have content. What captures complete packets?
A.VPC Traffic Mirroring to a monitoring target
Full packet capture = traffic mirroring. Correct.
B.DNS query logging
DNS logs show queries — not packet content.
C.CloudTrail data events
Data events log API actions on resources — not network packets.
D.NAT gateway logs
NAT gateways don't offer packet-level logs.
Why this answer
VPC Traffic Mirroring copies actual packet payloads from ENIs to a target (NLB, GWLB, or monitoring instance) — the packet-capture capability. Flow logs = metadata only; CloudTrail = control/data-plane API calls.
Correct answer: A · Last reviewed 2026-11-05
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Infrastructure Security practice session.
Practice Infrastructure Security