A SaaS company runs its application servers in private subnets. Outbound traffic leaves through a NAT gateway, and inbound traffic reaches the servers through an Application Load Balancer. The security team turns on VPC flow logs with a custom format, so that each record shows the original addresses and the TCP details.
The analysts need to answer five questions about these records. Match each question to the custom flow log field that answers it. Each option is used at most once, and one option is not needed.
Match each item to one answer. An answer can be used more than once, and some may not be used.
Items
Which private instance started a connection that left through the NAT gateway?
Which field shows connection attempts that carry only SYN flags, which suggests a port scan?
Which field shows how much data moved in each flow, so the analysts can find large transfers?
Which field shows whether a security group or network ACL allowed or blocked the traffic?
Which field names the network interface that captured the record, so the analysts can find the instance?
Answers
AA. bytes, the number of bytes transferred during the period that the flow record covers.
BB. pkt-srcaddr, the original source IP address of the packet, before NAT or load balancer translation.
CC. log-status, whether the flow record was logged normally, skipped, or had no data during the capture window.
DD. tcp-flags, the TCP flags seen during the flow, such as SYN, ACK, FIN and RST.
EE. interface-id, the ID of the network interface where the traffic was recorded.
FF. action, whether the traffic was accepted or rejected by a security group or network ACL.
Show the answer and explanation
Correct matches
Which private instance started a connection that left through the NAT gateway?: B. pkt-srcaddr, the original source IP address of the packet, before NAT or load balancer translation.
Which field shows connection attempts that carry only SYN flags, which suggests a port scan?: D. tcp-flags, the TCP flags seen during the flow, such as SYN, ACK, FIN and RST.
Which field shows how much data moved in each flow, so the analysts can find large transfers?: A. bytes, the number of bytes transferred during the period that the flow record covers.
Which field shows whether a security group or network ACL allowed or blocked the traffic?: F. action, whether the traffic was accepted or rejected by a security group or network ACL.
Which field names the network interface that captured the record, so the analysts can find the instance?: E. interface-id, the ID of the network interface where the traffic was recorded.
About each answer
A. Bytes shows how much data moved in each flow. It is the field to use when looking for large transfers out of the environment.
B. Pkt-srcaddr keeps the source address the packet had at the start, so it shows the private instance behind a NAT gateway. The plain srcaddr field would show the NAT interface instead.
C. Log-status reports the health of the logging itself. It shows whether records were written, but it says nothing about the traffic, so none of the five questions needs it.
D. Tcp-flags shows connection behavior, so a flow that carries only SYN flags across many ports suggests a port scan. This is the field for spotting probing attempts.
E. Interface-id names the network interface that captured the record. The analysts can use it to find the instance or load balancer that produced the traffic.
F. Action records the decision made by the security controls for each flow. It shows whether a connection was allowed or blocked, which matters for checking rules.
Explanation
Custom flow log formats add fields that show original packet addresses behind NAT and load balancers, plus TCP flags and the decision each flow received. Each analyst question maps to one field, and log-status only reports whether records were written. The matching follows the field definitions in the flow log record reference.
Want more on Network and DNS logs (VPC Flow Logs, Transit Gateway flow logs, Resolver query logs)? The 5 full-length practice sets have 7 more Network and DNS logs (VPC Flow Logs, Transit Gateway flow logs, Resolver query logs) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →