ANS-C01 Network Management and Operations Practice Question
A network engineer is monitoring network traffic using VPC Flow Logs. The engineer wants to capture traffic that is rejected by security groups and network ACLs. Which flow log format should be used?
⚠ Common exam trap
Be careful: The default format actually includes the action field. Many candidates mistakenly think it does not, leading them to choose D over A. While D is still the best answer, A is not invalid due to lacking the action field.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Custom format with 'action' field
The default VPC Flow Log format includes the action field, so it does capture ACCEPT/REJECT information. However, a common myth is that the default format omits the action field. In reality, both default and custom formats can capture rejected traffic. The correct answer is D because a custom format that explicitly includes the action field is the targeted way to capture only the rejection status, reducing log volume and making analysis easier. Option A is incorrect because it is not the most efficient approach; it logs many unnecessary fields. Options B and C are irrelevant or incomplete.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Default format
Why it's wrong here
Default format does not include the action field.
- ✗
Flow logs are delivered to CloudWatch Logs with DNS query logs
Why it's wrong here
VPC Flow Logs are not delivered with DNS query logs; DNS query logs are a separate feature (Route 53 Resolver query logs or VPC DNS query logs) and unrelated to flow log formats for capturing rejected traffic.
- ✗
Custom format with 'srcaddr' and 'dstaddr' only
Why it's wrong here
Missing the action field.
- ✓
Custom format with 'action' field
Why this is correct
The action field shows ACCEPT or REJECT.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.