SCS-C02 Security Logging and Monitoring Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Packet payload

  Why it's wrong here

  VPC Flow Logs are metadata-only records of network traffic; they never capture the actual data content, or payload, of IP packets. The payload is not part of the flow log schema because the service samples and reports only header-level information such as IP addresses, ports, and protocol. To inspect payload contents, you would need a separate solution like Traffic Mirroring or an agent-based packet capture. Thus, packet payload is not captured.

• ✓

  Source IP address

  Why this is correct

  This is the correct answer. VPC Flow Logs capture the source IP address in the srcaddr field for every accepted or rejected network connection, as part of the standard flow log record. The srcaddr field is available in all flow log versions and is used to identify the origin of the traffic. It is recorded regardless of whether the traffic was allowed or denied by security groups or network ACLs.

• ✗

  IAM user ID

  Why it's wrong here

  IAM user IDs are identity-layer information, while VPC Flow Logs operate at the network interface layer and therefore have no field for IAM identities. The flow log record contains only network metadata such as IP addresses and ports, not the principal who initiated the connection. To map traffic to a specific IAM user, you must correlate flow logs with authentication records like AWS CloudTrail. An IAM user ID is never captured in a VPC Flow Log.

• ✓

  Destination port

  Why this is correct

  This is also a correct answer. The destination port is a standard field in VPC Flow Logs, recorded as dstport, indicating the port on the destination host to which the packet was sent. It is part of the 5-tuple (along with source/destination IPs, source port, and protocol) that uniquely identifies a flow. The destination port is captured for both accepted and rejected traffic, making it useful for understanding which application or service was being accessed.

• ✗

  DNS query name

  Why it's wrong here

  DNS query names are application-layer payload content, not network header metadata, so VPC Flow Logs do not capture them. Flow logs sample IP traffic metadata at the hypervisor level and never inspect the payload of DNS packets or other application protocols. To log DNS query names, you would need Route 53 DNS logging or a dedicated packet-capture tool such as Traffic Mirroring. Therefore, a DNS query name is not a field in VPC Flow Logs.

Go deeper

Related to this question