DOP-C02 Incident and Event Response Practice Question

A company runs a critical application on Amazon ECS with Fargate launch type. The application experiences intermittent connection timeouts when calling an external API. The engineer needs to capture network traffic to diagnose the issue. Which solution is most appropriate?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable VPC Flow Logs on the ECS task's elastic network interface.

VPC Flow Logs capture network traffic metadata at the elastic network interface (ENI) level, which can be analyzed to identify dropped packets, timeouts, and other connectivity issues. For ECS tasks with Fargate, each task gets its own ENI, so enabling VPC Flow Logs on that ENI provides network-level diagnostics without needing to run commands inside the container. Option A is wrong because CloudWatch Logs captures application logs, not network packets. Option C is wrong because AWS X-Ray traces requests and provides latency information but does not capture raw network traffic. Option D is wrong because Fargate does not use underlying EC2 instances that the user can access; thus, running tcpdump is not possible.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Enable detailed CloudWatch Logs for the ECS task.
Why it's wrong here
CloudWatch Logs receives only the output that the application writes to stdout/stderr via the awslogs log driver; it never sees network packets, connection attempts, or security group decisions. Enabling detailed log collection for the ECS task would let you inspect container logs and error traces, but it cannot show whether packets are being dropped at the VPC/NACL layer or whether a specific port is unreachable.
✓
Enable VPC Flow Logs on the ECS task's elastic network interface.
Why this is correct
VPC Flow Logs on the task's elastic network interface capture connection-level metadata — source and destination IP, ports, protocol, and whether the packet was accepted or rejected — for every flow through the ENI. They can be published to CloudWatch Logs or S3 and queried to correlate application failures with security group rule actions or network ACL denials. Because each Fargate task has a dedicated ENI, flow logs are the only one of these options that provides the raw network reachability data needed to diagnose connectivity issues.
✗
Enable AWS X-Ray tracing on the ECS task.
Why it's wrong here
AWS X-Ray instruments application-level requests using SDKs and a tracing daemon, generating segments and subsegments for HTTP calls, database queries, and downstream service invocations. It does not capture packet-level details or inspect the network stack, so it cannot reveal dropped packets, security group rejections, or unroutable IP traffic. X-Ray's value is understanding distributed request propagation and latency, not diagnosing whether the network path itself is intact.
✗
Run tcpdump on the EC2 instance hosting the ECS task.
Why it's wrong here
Fargate is a serverless compute model that abstracts away the underlying EC2 instances; you have no ability to SSH into a host or install and run tcpdump. Even if you attempted to attach to the host, AWS does not expose a shell or network capture capability on the Fargate node, and tcpdump would require root-level host access that is never granted. Therefore, packet capture tools that require host OS-level interception are simply unavailable in a Fargate environment.

Go deeper

DOP-C02 Incident and Event Response Practice Question

Why each option matters

Option-by-option breakdown

Related to this question