SCS-C02 Security Logging and Monitoring Practice Question
A security engineer manages a VPC with a fleet of Amazon EC2 instances running behind an Application Load Balancer. The engineer needs to capture, in near real time, metadata about all IP traffic entering and leaving the network interfaces in the VPC, including source and destination IP, ports, and protocol, and then store the records in Amazon S3 for later analysis. Which solution meets these requirements with the LEAST operational overhead?
⚠ Common exam trap
The trap here is assuming that CloudTrail or the CloudWatch agent can capture network traffic metadata, when only VPC Flow Logs provide that specific IP-level detail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable VPC Flow Logs at the VPC level with a destination of Amazon S3 and the default format.
VPC Flow Logs are the native AWS feature for capturing IP traffic metadata for network interfaces in a VPC. Publishing directly to Amazon S3 avoids the need for agents or custom pipelines and provides the required fields in the default format. The other options either capture the wrong type of data or introduce unnecessary complexity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Install the CloudWatch agent on each EC2 instance and configure it to collect network traffic metrics and send them to CloudWatch Logs.
Why it's wrong here
The CloudWatch agent collects system-level metrics and logs from inside the operating system, not per-packet IP metadata for all traffic on the network interface. It cannot see traffic between other instances or traffic that bypasses the host, so it would not provide the required VPC-wide IP traffic records. This approach also adds agent management overhead.
- ✓
Enable VPC Flow Logs at the VPC level with a destination of Amazon S3 and the default format.
Why this is correct
VPC Flow Logs capture IP traffic metadata for network interfaces in a VPC, including source/destination IP, ports, and protocol. Publishing directly to Amazon S3 requires no agent installation or additional pipeline, making it the lowest-overhead solution. The default format already includes the required fields, and flow logs can be created at the VPC, subnet, or ENI level.
- ✗
Deploy a third-party network monitoring appliance on an EC2 instance and mirror all VPC traffic to it using AWS PrivateLink.
Why it's wrong here
AWS PrivateLink provides private connectivity to services, not traffic mirroring. To mirror traffic, you would use VPC Traffic Mirroring, and a third-party appliance adds significant operational overhead for deployment, scaling, and maintenance. This is not the least-overhead solution, and PrivateLink does not perform the required function.
- ✗
Enable AWS CloudTrail data events on the network interfaces and deliver the logs to Amazon S3.
Why it's wrong here
CloudTrail data events record resource operations such as S3 object-level API calls or Lambda invocations, not IP traffic flows. CloudTrail does not capture packet-level metadata like source/destination ports or protocol. Therefore, it cannot satisfy the requirement to log all IP traffic entering and leaving network interfaces.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.