VPC Flow Logs

Correct Answer: VPC Flow Logs with reject filter

VPC Flow Logs with a reject filter is the best solution for monitoring and analyzing rejected VPC traffic. CloudTrail Logs are for API calls, CloudWatch Alarms for triggering events on metrics, AWS Config Rules are for validating resource configurations, S3 Access Logs record S3 data, and AWS GuardDuty is a continuous security monitoring service.

Correct Answer: S3

S3 is the correct choice for storing VPC Flow Logs with a 90-day retention period. Glacier is for long-term storage with retrieval times in hours, RDS is a relational database, ElasticSearch is a search engine, DynamoDB is a NoSQL database, and EFS is a network file system.

Correct Answer: Enable and review VPC Flow Logs for the instance’s ENI or subnet; filter for traffic to ports 22/3389 from developer source IPs and check action=ACCEPT/REJECT; if REJECT, update security group/NACL rules, and if no records appear, verify the subnet route table and IGW/NAT path.

To troubleshoot SSH/RDP connectivity with VPC Flow Logs, first ensure logs are enabled on the relevant ENI or subnet and filter for attempts to ports 22/3389 from the developers’ source IPs. The action field in the flow log shows whether the traffic was ACCEPTed or REJECTed. REJECT entries indicate a policy issue, typically in security group or network ACL rules, which should be updated to permit the traffic. If no records are present, the traffic is not reaching the instance’s ENI at all, which usually points to routing or internet/NAT gateway configuration problems, so verifying the subnet route table and gateway associations is the next step.