A security team needs full packet copies from specific EC2 instances sent to an appliance for deep-packet inspection — without installing agents. What provides this?
A.VPC Flow Logs
Flow Logs record connection metadata (IPs, ports, bytes) — no packet contents.
B.VPC Traffic Mirroring
Correct. Mirroring delivers encapsulated copies of actual packets to your inspection target.
C.AWS Network Firewall
Network Firewall inspects traffic in-line at the VPC boundary, not copies from arbitrary instance ENIs.
D.Route 53 Resolver query logs
Resolver logs cover DNS queries only.
Why this answer
Traffic Mirroring copies network packets from ENIs of selected instances to a mirror target (NLB or appliance ENI) — agentless, full-packet capture for inspection tools. Flow Logs are metadata only, not payloads.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Security practice session.
Practice Network Security