ANS-C01 Network Management and Operations Practice Question
A company has a VPC with multiple subnets. The network engineer wants to monitor network traffic between two specific EC2 instances in different subnets. Which THREE methods can be used to capture and analyze this traffic?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable VPC Flow Logs for the subnets containing the instances.
VPC Flow Logs capture metadata, Traffic Mirroring captures full packets, and AWS Network Firewall can inspect traffic. VPC Peering is for connectivity, not monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable VPC Flow Logs for the subnets containing the instances.
Why this is correct
Flow logs will show metadata of all traffic, including between the instances.
- ✓
Configure Traffic Mirroring on one of the instances' ENI.
Why this is correct
Traffic Mirroring can capture all packets from the source instance.
- ✗
Use AWS CloudTrail to log network traffic.
Why it's wrong here
CloudTrail logs API calls, not network packets.
- ✗
Create a VPC peering connection between the two subnets' VPCs.
Why it's wrong here
Peering connects VPCs, but does not inherently monitor traffic.
- ✓
Set up AWS Network Firewall and route traffic through it.
Why this is correct
Network Firewall can inspect and log traffic passing through it.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to monitor network traffic to and from an EC2 instance to detect anomalous outbound traffic. Which AWS service should they use to capture and analyze the traffic?
easy- A.Amazon GuardDuty
- B.Amazon CloudWatch Logs
- C.AWS Config
- ✓ D.VPC Traffic Mirroring
Why D: VPC Traffic Mirroring (option D) is correct because it captures and copies network traffic from EC2 instances for analysis. Amazon GuardDuty (option A) is a threat detection service that analyzes logs and findings but does not capture raw traffic. Amazon CloudWatch Logs (option B) can capture application and system logs, but not full packet-level traffic. AWS Config (option C) records configuration changes to resources, not network traffic. Therefore, VPC Traffic Mirroring is the appropriate service for capturing and analyzing network traffic to detect anomalous outbound behavior.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.