SOA-C02 Networking and Content Delivery Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  HTTP status code

  Why it's wrong here

  VPC Flow Logs capture metadata about network traffic at Layers 3 and 4 of the OSI model, such as IP addresses, ports, and protocol numbers. They do not perform deep packet inspection or parse application-layer payloads, so an HTTP status code (a Layer 7 concept) is never present in a flow log record. To monitor HTTP status codes, you would need to enable webserver access logs or use an agent-based solution like Amazon CloudWatch Agent.

• ✓

  Protocol number

  Why this is correct

  The protocol number field in a VPC Flow Log record identifies the IP protocol used for the traffic, using IANA-assigned numbers (e.g., 6 for TCP, 17 for UDP, 1 for ICMP). This numeric value is captured directly from the IP header, independent of the application layer. Flow log records include this field regardless of whether the traffic is TCP, UDP, or another protocol, making it a reliable attribute for filtering and analyzing traffic types.

• ✓

  Source IP address

  Why this is correct

  VPC Flow Logs record the source IP address in the 'srcaddr' field, which is the IPv4 or IPv6 address that originated the traffic. This field is captured from the packet's IP header, so it always exists for accepted, rejected, and no-data flow records that represent actual traffic. You can use it to identify the origin of communications, such as a specific EC2 instance's private IP or a public IP from the internet.

• ✗

  DNS query name

  Why it's wrong here

  DNS query names are application-layer data carried in the payload of DNS packets sent to port 53, typically over UDP or TCP. VPC Flow Logs do not inspect packet payloads; they only log flow metadata like IP addresses, ports, and protocol numbers. To capture DNS query names, you must use separate DNS logging features such as Amazon Route 53 Resolver query logging or configure your own DNS server logs.

• ✓

  Destination IP address

  Why this is correct

  The destination IP address is stored in the 'dstaddr' field of a VPC Flow Log record and represents the IP address to which the traffic was sent. Similar to the source IP, this value is extracted from the IP header and is always present for traffic flows recorded in the log. It is essential for determining which resource received the communication, such as an EC2 instance, an internet gateway, or another private IP within the VPC.

Go deeper

Related to this question