SOA-C02 Monitoring, Logging, and Remediation Practice Question
An application is running on an EC2 instance and is experiencing intermittent connection timeouts. The SysOps administrator wants to capture network traffic to analyze the issue. Which AWS service should be used?
⚠ Common exam trap
Candidates often confuse VPC Flow Logs (which capture network traffic metadata) with CloudWatch Logs (which capture application/system logs) or CloudTrail (which captures API activity), leading them to choose a logging service that cannot diagnose network-level issues.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPC Flow Logs
VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including accepted and rejected connection attempts. This allows the SysOps administrator to analyze the source/destination IPs, ports, protocols, and whether the traffic was allowed or denied, which is essential for diagnosing intermittent connection timeouts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CloudWatch Logs
Why it's wrong here
CloudWatch Logs is a service for collecting, monitoring, and storing log files from applications and EC2 instances via the CloudWatch agent or SDKs. It does not capture network traffic metadata such as source/destination IPs, ports, or protocols; instead, it ingests text-based log events generated by the OS or application. Therefore, while it can be used to store VPC Flow Logs as a destination, it is not the direct source of network traffic data.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail records API activity across AWS services, including actions taken by users, roles, or services that create, modify, or delete resources. It provides governance, compliance, and audit history for management-plane operations, but it does not capture data-plane traffic flowing through an EC2 instance's network interface. Thus, CloudTrail cannot reveal network traffic patterns, latency, or transmission details for the application's traffic.
- ✗
AWS Config
Why it's wrong here
AWS Config is a service that tracks resource configuration changes and evaluates those configurations against desired policies. It records when an EC2 instance is launched, stopped, or has its security groups modified, but it does not observe or log the actual network packets or connection-level metadata traversing the instance. Config focuses on the state of resources over time, not on the data flowing through them.
- ✓
VPC Flow Logs
Why this is correct
VPC Flow Logs is a feature of Amazon VPC that captures metadata about IP traffic going to and from network interfaces in a VPC, including the ENI attached to the EC2 instance. Each flow log record includes fields such as source/destination IP, port, protocol, packet/byte counts, and whether the traffic was accepted or rejected by security groups/network ACLs. This makes it the correct service for diagnosing connectivity issues, analyzing traffic patterns, or investigating security incidents, as it directly provides network traffic metadata at the flow level.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.