SCS-C02 Infrastructure Security Practice Question
A security engineer is configuring a VPC flow log to detect unusual traffic patterns. The engineer notices that some traffic between two EC2 instances in the same VPC appears in the flow logs as NODATA records, and other connections appear as REJECT records. The engineer must determine what each record type indicates before building detections. Which statement correctly describes the difference?
⚠ Common exam trap
The trap here is reading NODATA as evidence of a blocked connection, when it actually only indicates that no matching traffic was observed in the interval.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NODATA indicates that no traffic matched the flow log record during the aggregation interval, while REJECT indicates that traffic was present but was blocked by a security group or network ACL.
VPC flow logs emit ACCEPT, REJECT, and NODATA records. A REJECT record means packets were seen but denied, typically by a security group or network ACL, while NODATA means the aggregation interval elapsed with no matching packets captured, which is useful for confirming that a monitored flow simply never occurred.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NODATA indicates that a security group blocked the traffic, while REJECT indicates that a network ACL blocked the traffic.
Why it's wrong here
The record type does not distinguish which control blocked the traffic; both security groups and network ACLs produce REJECT records when they deny packets. NODATA does not describe a blocked connection at all, so this mapping misrepresents the meaning of both record types.
- ✓
NODATA indicates that no traffic matched the flow log record during the aggregation interval, while REJECT indicates that traffic was present but was blocked by a security group or network ACL.
Why this is correct
NODATA means the capture window closed with no matching packets, which is common for flows that are logging only accepted or only rejected traffic. REJECT means packets were observed but denied by a security group, network ACL, or similar control, so the connection attempt is visible in the record.
- ✗
NODATA indicates that traffic was rejected by an AWS WAF rule, while REJECT indicates that traffic was allowed by a security group.
Why it's wrong here
AWS WAF operates at the application layer on resources such as Application Load Balancers and CloudFront distributions and does not appear in VPC flow logs as a REJECT or NODATA record. REJECT never indicates allowed traffic; allowed connections appear as ACCEPT records when accepted-traffic logging is enabled.
- ✗
NODATA indicates that the flow log was disabled for the resource, while REJECT indicates that the destination port was unreachable.
Why it's wrong here
A disabled flow log stops producing records entirely rather than producing NODATA entries for the resource. REJECT is not about an unreachable port; it specifically signals that a security control denied the packets that were observed during the aggregation interval.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.