Exams / SCS-C03 / Study guide / Network and DNS logs (VPC Flow Logs, Transit Gateway flow logs, Resolver query logs)
Network and DNS logs (VPC Flow Logs, Transit Gateway flow logs, Resolver query logs): SCS-C03 study notes and practice questions
What to know about Network and DNS logs (VPC Flow Logs, Transit Gateway flow logs, Resolver query logs) for the SCS-C03 exam, from the Detection domain (16% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.
These questions ask how to see network activity, such as which instance talked to a suspicious address, which domain names a workload resolved or which path traffic took between VPCs. You choose the log type that records the needed fact, and you know its blind spots, because a flow log never shows packet contents.
VPC Flow Logs
A VPC flow log captures metadata for IP traffic: source and destination addresses and ports, protocol, packet and byte counts, and whether traffic was accepted or rejected. You can enable it for a VPC, a subnet or a single network interface.
Logs go to CloudWatch Logs, S3 or Firehose. Delivery needs permission: a CloudWatch Logs destination needs an IAM role that can publish logs, and an S3 destination needs a bucket policy that allows delivery.
Flow logs are aggregated over short intervals, so they are not a real-time feed.
Flow logs do not record traffic to the Amazon-provided DNS server, DHCP traffic or traffic to the instance metadata address. If you run your own DNS server, traffic to it is logged.
Route 53 Resolver query logs
Resolver query logging records DNS queries that resources in a VPC send to the Route 53 Resolver, including the query name, type and response. Enable it per VPC and send it to CloudWatch Logs, S3 or Firehose.
This is the source for “which domain names did this instance look up”, including lookups answered by the Amazon DNS server.
Transit Gateway and firewall logs
Transit Gateway flow logs record traffic at Transit Gateway attachments, which is how you see traffic between VPCs and on-premises networks that pass through the gateway.
Network Firewall sends alert and flow logs to S3, CloudWatch Logs or Firehose, showing which rule matched a connection.
How to choose
Scenario wording
Pick
Which addresses and ports talked to an instance, and whether they were accepted
VPC Flow Logs
Which domain names did the workload look up, including through Amazon DNS
Route 53 Resolver query logs
Traffic between VPCs and on-premises through a Transit Gateway
Transit Gateway flow logs
Which firewall rule matched a connection
Network Firewall alert logs
Detect command-and-control traffic without building a log pipeline
GuardDuty, which reads flow and DNS logs itself
Read the contents of packets
Not a log feature; packet-level analysis is out of scope
Common traps
Expecting flow logs to show DNS lookups to Amazon DNS. Use Resolver query logs for that.
Expecting flow logs to show HTTP requests or payloads. They show metadata only.
Enabling flow logs on one subnet when the question asks for the whole VPC or the instance’s network interface.
Assuming flow logs alert on their own. Logs need a query, a metric filter or GuardDuty to produce a signal.
Forgetting the delivery role or bucket policy, which leaves the log group or bucket empty.
A SaaS company runs its application servers in private subnets. Outbound traffic leaves through a NAT gateway, and inbound traffic reaches the servers through an Application Load Balancer. The security team turns on VPC flow logs with a custom format, so that each record shows the original addresses and the TCP details.
The analysts need to answer five questions about these records. Match each question to the custom flow log field that answers it. Each option is used at most once, and one option is not needed.
Match each item to one answer. An answer can be used more than once, and some may not be used.
Items
Which private instance started a connection that left through the NAT gateway?
Which field shows connection attempts that carry only SYN flags, which suggests a port scan?
Which field shows how much data moved in each flow, so the analysts can find large transfers?
Which field shows whether a security group or network ACL allowed or blocked the traffic?
Which field names the network interface that captured the record, so the analysts can find the instance?
Answers
AA. bytes, the number of bytes transferred during the period that the flow record covers.
BB. pkt-srcaddr, the original source IP address of the packet, before NAT or load balancer translation.
CC. log-status, whether the flow record was logged normally, skipped, or had no data during the capture window.
DD. tcp-flags, the TCP flags seen during the flow, such as SYN, ACK, FIN and RST.
EE. interface-id, the ID of the network interface where the traffic was recorded.
FF. action, whether the traffic was accepted or rejected by a security group or network ACL.
Show the answer and explanation
Correct matches
Which private instance started a connection that left through the NAT gateway?: B. pkt-srcaddr, the original source IP address of the packet, before NAT or load balancer translation.
Which field shows connection attempts that carry only SYN flags, which suggests a port scan?: D. tcp-flags, the TCP flags seen during the flow, such as SYN, ACK, FIN and RST.
Which field shows how much data moved in each flow, so the analysts can find large transfers?: A. bytes, the number of bytes transferred during the period that the flow record covers.
Which field shows whether a security group or network ACL allowed or blocked the traffic?: F. action, whether the traffic was accepted or rejected by a security group or network ACL.
Which field names the network interface that captured the record, so the analysts can find the instance?: E. interface-id, the ID of the network interface where the traffic was recorded.
About each answer
A. Bytes shows how much data moved in each flow. It is the field to use when looking for large transfers out of the environment.
B. Pkt-srcaddr keeps the source address the packet had at the start, so it shows the private instance behind a NAT gateway. The plain srcaddr field would show the NAT interface instead.
C. Log-status reports the health of the logging itself. It shows whether records were written, but it says nothing about the traffic, so none of the five questions needs it.
D. Tcp-flags shows connection behavior, so a flow that carries only SYN flags across many ports suggests a port scan. This is the field for spotting probing attempts.
E. Interface-id names the network interface that captured the record. The analysts can use it to find the instance or load balancer that produced the traffic.
F. Action records the decision made by the security controls for each flow. It shows whether a connection was allowed or blocked, which matters for checking rules.
Explanation
Custom flow log formats add fields that show original packet addresses behind NAT and load balancers, plus TCP flags and the decision each flow received. Each analyst question maps to one field, and log-status only reports whether records were written. The matching follows the field definitions in the flow log record reference.
Want more on Network and DNS logs (VPC Flow Logs, Transit Gateway flow logs, Resolver query logs)? The 5 full-length practice sets have 7 more Network and DNS logs (VPC Flow Logs, Transit Gateway flow logs, Resolver query logs) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Network and DNS logs (VPC Flow Logs, Transit Gateway flow logs, Resolver query logs)