DOP-C02 Incident and Event Response Practice Question
A DevOps engineer is investigating a security incident where an EC2 instance was used to launch an outbound DDoS attack. Which AWS service can provide details about the source IP addresses and network traffic from the instance?
⚠ Common exam trap
DOP-C02 often tests the distinction between network telemetry (VPC Flow Logs) and API audit (CloudTrail) — the trap is choosing CloudTrail because it 'logs activity' when the question asks for source IPs and network traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPC Flow Logs
VPC Flow Logs capture IP traffic metadata for network interfaces in a VPC, including source and destination IP addresses, ports, protocol, and accept/reject status. For an EC2 instance launching an outbound DDoS attack, flow logs provide the source IPs and traffic patterns needed to identify the attack destinations and volume. This is the service designed for network-level traffic visibility.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
VPC Flow Logs
Why this is correct
VPC Flow Logs are correct because they capture IP traffic metadata at the elastic network interface level, including source/destination IP addresses, ports, protocol, and the accept/reject action for each flow. This data directly shows which connections were made, from where, and to which destination, enabling a DevOps engineer to trace the communication patterns involved in the incident. These logs can be enabled per VPC, subnet, or ENI and delivered to CloudWatch Logs or S3 for analysis.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail is wrong because it records control-plane API actions in your AWS account, such as RunInstances, AuthorizeSecurityGroupIngress, or CreateNetworkAcl, rather than the data-plane network traffic itself. It provides an audit trail of who called which API and when, but it cannot reveal the actual IP packets, connection metadata, or payloads that flowed between hosts. Therefore, while CloudTrail may help show when a security group rule was changed, it offers no visibility into the traffic that was facilitated by that change.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is wrong because it is a threat-detection service that consumes existing telemetry sources, including VPC Flow Logs, DNS logs, and CloudTrail management events, to generate intelligent security findings. It flags suspicious activity such as crypto-mining or port scanning, but it does not store or expose raw flow log records for you to inspect. To investigate the actual traffic, you would still need the original VPC Flow Logs; GuardDuty can only tell you that something bad may have occurred, not provide the packet-level metadata itself.
- ✗
AWS Config
Why it's wrong here
AWS Config is wrong because it continuously records and evaluates configuration changes to AWS resources, such as changes to security group rules, NACLs, or routing tables, against desired policies. It is a configuration-management and compliance tool, not a network-traffic capture tool, so it cannot log individual IP flows or connection attempts. At best, it can reveal that a security group was opened to 0.0.0.0/0 before the incident, but it cannot show the traffic that actually utilized that rule.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.