SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company's AWS environment includes multiple VPCs across several accounts that are connected via a transit gateway. The network team wants to monitor all network traffic between VPCs for security analysis. Which solution is the most scalable and cost-effective?
⚠ Common exam trap
The trap here is that candidates may over-engineer the solution by choosing Traffic Mirroring or NLB-based packet capture, thinking full packet inspection is needed, when metadata from Flow Logs is sufficient for security analysis and far more cost-effective at scale.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable VPC Flow Logs and publish them to a central S3 bucket, then use Amazon Athena to query the logs.
VPC Flow Logs capture IP traffic metadata (not full packets) and can be centrally published to an S3 bucket across accounts using a central logging account. Querying with Athena is serverless, scales automatically, and incurs cost only for data scanned, making it the most scalable and cost-effective solution for security analysis of inter-VPC traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Traffic Mirroring to mirror all traffic to a central inspection appliance.
Why it's wrong here
High cost and complexity.
- ✓
Enable VPC Flow Logs and publish them to a central S3 bucket, then use Amazon Athena to query the logs.
Why this is correct
Scalable and cost-effective.
- ✗
Enable VPC Flow Logs for each VPC and stream them to Amazon CloudWatch Logs in each account.
Why it's wrong here
Logs are not centralized.
- ✗
Place a network load balancer in each VPC and capture traffic using a packet sniffer.
Why it's wrong here
Not designed for traffic monitoring.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.