An app reports connectivity failures. The team wants to see whether packets are being rejected by a security group or NACL at the VPC layer. What records ACCEPT/REJECT decisions?
A.CloudTrail
CloudTrail = control-plane API events.
B.VPC Flow Logs — capture ACCEPT/REJECT per ENI/subnet/VPC traffic
Correct. Packet-level accept/reject records.
C.Route 53 query logs
DNS logs — different layer entirely.
D.ALB access logs
ALB logs only cover LB-received traffic.
Why this answer
Flow Logs record accept/reject metadata for IP traffic at the ENI level — the tool for diagnosing SG/NACL blocks without touching instances. CloudTrail logs API calls, not packets; ALB logs only show traffic that reached the load balancer.
Correct answer: B · Last reviewed 2026-11-03
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Operations practice session.
Practice Network Operations