ANS-C01 Network Management and Operations Practice Question
A company has a hybrid network with multiple VPCs connected via a Transit Gateway. They want to centralize outbound internet traffic through a single VPC with a NAT gateway. The security team requires that all traffic to the internet must be logged. Which solution is MOST operationally efficient?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable VPC Flow Logs on the central VPC and publish to Amazon CloudWatch Logs
The most operationally efficient solution is to enable VPC Flow Logs on the central VPC and publish them to Amazon CloudWatch Logs. This captures all traffic passing through the VPC, including internet-bound traffic routed through the NAT gateway, and provides a centralized logging solution. Option A is incorrect because VPC Flow Logs on the NAT gateway's subnet only capture traffic for that subnet, not all internet-bound traffic from other VPCs routed through the Transit Gateway. Option C is incorrect because deploying a third-party firewall adds unnecessary complexity and cost. Option D is incorrect because AWS CloudTrail logs API calls, not network traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable VPC Flow Logs on the NAT gateway's subnet and publish to Amazon S3
Why it's wrong here
Flow Logs on the subnet capture all traffic, not just through the NAT gateway.
- ✓
Enable VPC Flow Logs on the central VPC and publish to Amazon CloudWatch Logs
Why this is correct
Captures all IP traffic and can be analyzed.
- ✗
Deploy a third-party firewall appliance in the central VPC and enable logging
Why it's wrong here
Adds complexity and is not needed.
- ✗
Enable AWS CloudTrail to log all network events
Why it's wrong here
CloudTrail logs API calls, not network traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.