SCS-C02 Infrastructure Security Practice Question

A company has a requirement to log all network traffic flowing through a VPC, including traffic between EC2 instances within the same subnet. Which AWS service should be used?

⚠ Common exam trap

SCS-C02 often tests the confusion between VPC Flow Logs (network traffic metadata), CloudTrail (API activity), and GuardDuty (threat detection), tricking candidates into selecting CloudTrail for network-level logging.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

VPC Flow Logs

VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including traffic between EC2 instances within the same subnet, and can be published to CloudWatch Logs or S3. It is the only AWS service listed that provides packet-level metadata for all traffic flowing through VPC network interfaces.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
VPC Flow Logs
Why this is correct
VPC Flow Logs is the only option that captures network traffic itself. It records flow metadata for every accepted and rejected connection at the VPC, subnet, or elastic network interface (ENI) level, including intra-subnet traffic between instances. The logs contain source/destination addresses, source/destination ports, protocol, packets, bytes, and the connection action, and can be published to CloudWatch Logs or Amazon S3 for analysis. While it captures flow metadata rather than packet payloads, it fully meets a requirement to log all network traffic for audit and troubleshooting.
✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat-detection service that analyzes ingested data sources, including VPC Flow Logs, AWS DNS logs, and CloudTrail events, to identify suspicious activity. It consumes VPC Flow Logs as an input, but it does not generate, store, or export raw flow logs on its own. Enabling GuardDuty alone would not satisfy the logging requirement; VPC Flow Logs must be enabled separately before GuardDuty can analyze them.
✗
AWS Config
Why it's wrong here
AWS Config is a configuration management and compliance service, not a traffic-logging service. It tracks resource configuration snapshots and changes, such as an added security-group rule on an EC2 instance, and evaluates those configurations against AWS-managed or custom rules. Although a configuration change can affect whether traffic is allowed, AWS Config never observes or stores actual IP flows or packets, so it cannot fulfill a network-traffic logging requirement.
✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail records control-plane API activity: every API call made by users, roles, or AWS services through the Management Console, CLI, or SDK. It captures events such as RunInstances or ModifySecurityGroup, but it does not observe the resulting data-plane network flows between resources. Because the company needs to log network traffic—connections, packets, and transfers between instances—CloudTrail is focused on who made which API calls, not on IP traffic, making it the wrong service.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Infrastructure Security Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question