DOP-C02 Incident and Event Response Practice Question
An application running on Amazon EC2 instances in an Auto Scaling group is experiencing intermittent connectivity issues. The DevOps team suspects a security group configuration problem. Which approach should the team use to analyze security group traffic and identify denied requests?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable VPC Flow Logs and query Amazon Athena
VPC Flow Logs capture all network traffic (accepted and rejected) and can be queried using Amazon Athena to identify denied requests. Option A is incorrect because AWS Config records resource configuration changes, not network traffic. Option B is incorrect because AWS CloudTrail logs API calls, not network traffic. Option C is incorrect because AWS Security Hub aggregates security findings from various services but does not log individual traffic flows. Therefore, enabling VPC Flow Logs and querying Athena is the appropriate approach to analyze security group traffic and identify denied requests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Config to review security group rules
Why it's wrong here
AWS Config evaluates and records security group configuration against managed rules, such as flagging overly permissive ingress CIDRs, but it never sees actual IP traffic traversing the VPC. Its findings are configuration-level compliance snapshots, not flow-level records of accepted or denied connections. Therefore, it cannot reveal which specific sources were rejected or why a connection failed.
- ✗
Check AWS CloudTrail for security group modification events
Why it's wrong here
AWS CloudTrail captures control-plane API activity, including calls like AuthorizeSecurityGroupIngress or RevokeSecurityGroupIngress, so it can prove a rule was added or removed and by whom. However, denied connection attempts occur on the data plane and are not API calls, so CloudTrail produces no log entry for each blocked packet or connection. It cannot supply source IPs, ports, or the volume of REJECT actions needed to diagnose denied traffic.
- ✗
Enable AWS Security Hub and review the security findings
Why it's wrong here
AWS Security Hub aggregates findings from services such as GuardDuty, Macie, and Inspector, and it can highlight misconfigurations or threats. But its findings are curated, event-driven, and often based on sampled or detected activity, not an exhaustive record of every network connection attempted through a security group. It may mention suspicious traffic, but it does not provide a queryable log of all denied connections with source/destination metadata for forensic analysis.
- ✓
Enable VPC Flow Logs and query Amazon Athena
Why this is correct
VPC Flow Logs capture IP traffic metadata for ENIs in the VPC, recording fields like source address, destination address, port, protocol, and the action — ACCEPT or REJECT — for each connection. By publishing flow logs to Amazon S3 and using Amazon Athena with its SerDe, you can run SQL queries to filter on action = 'REJECT' and aggregate the denied connection attempts by source IP, port, or time. This directly reveals which connections are being blocked, making it the correct way to investigate denied traffic.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 251 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.