How to Configure AWS Network Firewall Logging for Full Traffic Auditing?

ANS-C01 By islever Editorial Last updated

Short answer

B Configure Network Firewall logging in Network Firewall to capture all alerts and flow logs.

Question

A company is developing a new application that is deployed in multiple VPCs across multiple AWS Regions. The VPCs are connected through AWS Transit Gateway. The VPCs contain private subnets and public subnets. All outbound internet traffic in the private subnets must be audited and logged. The company's network engineer plans to use AWS Network Firewall and must ensure that all traffic through Network Firewall is completely logged for auditing and alerting. How should the network engineer configure Network Firewall logging to meet these requirements?
  1. Configure Network Firewall logging in Amazon CloudWatch to capture all alerts. Send the logs to a log group in Amazon CloudWatch Logs.
  2. Configure Network Firewall logging in Network Firewall to capture all alerts and flow logs. Correct Answer
  3. Configure Network Firewall logging by configuring VPC Flow Logs for the firewall endpoint. Send the logs to a log group in Amazon CloudWatch Logs.
  4. Configure Network Firewall logging by configuring AWS CloudTrail to capture data events.

Key Takeaways

This question tests whether candidates know that AWS Network Firewall has its own logging configuration for both alert and flow logs, and that enabling only one log type is insufficient for complete traffic auditing.

AWS Network Firewall supports two distinct log types: alert logs and flow (traffic) logs. To fully audit all traffic, both log types must be enabled within the Network Firewall logging configuration.

Common mistake: Many candidates choose Option A because it mentions CloudWatch Logs, a valid destination, but it only enables alert logs, missing the required flow logs for full traffic auditing.

Expert Analysis

Understanding AWS Network Firewall Logging Types

AWS Network Firewall generates two fundamentally different types of logs:

  • Alert logs: Contain information about traffic that matches a stateful rule or triggers a stateful rule evaluation alert.
  • Flow logs (also called traffic logs): Contain information about every connection that flows through the firewall endpoint, regardless of whether a rule matched.
The requirement in the question is clear: all outbound internet traffic must be audited and logged. This means every connection, not just the ones that trigger an alert, must be captured.

Why Option B Is Correct

Option B states: "Configure Network Firewall logging in Network Firewall to capture all alerts and flow logs."

This is the only option that explicitly enables both log types directly within the Network Firewall service. As community member kupo777 and KobDragoon correctly pointed out, the destination (S3, CloudWatch Logs, or Kinesis Data Firehose) is secondary to the requirement of capturing both log types. The question asks how to configure logging to ensure all traffic is logged, not where to send the logs.

Why the Other Options Are Wrong

  • Option A: Configures only alert logs in CloudWatch. Alert logs alone do not capture all traffic—only traffic that matches a rule. This fails the "completely logged" requirement.
  • Option C: Suggests using VPC Flow Logs on the firewall endpoint ENIs. VPC Flow Logs operate at the ENI level and do not provide the deep packet inspection or stateful rule evaluation context that Network Firewall flow logs provide. Moreover, VPC Flow Logs cannot capture alert-level data.
  • Option D: Suggests AWS CloudTrail data events. CloudTrail captures API calls made to the Network Firewall service (e.g., CreateFirewall, UpdateFirewallPolicy), not the actual traffic flowing through the firewall. This is entirely irrelevant to traffic auditing.

Key Takeaway

When the requirement is to audit all traffic through AWS Network Firewall, you must enable both alert logs and flow logs in the firewall's own logging configuration. The destination (CloudWatch, S3, or Firehose) is a secondary choice and does not determine completeness of the logs.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question asks to 'completely log' or 'audit all traffic' through a firewall service, look for the option that enables both alert and flow/traffic logs. Distractors often mention a valid log destination (like CloudWatch) but only enable one log type—always verify that the option covers the full scope of the requirement.

Community Votes

B
78%
A
22%

78% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. bluz 👍 6 Answered B
    "to capture all alerts and flow logs"
  2. jinu 👍 5
    A- https://docs.aws.amazon.com/network-firewall/latest/developerguide/logging-cw-logs.html
  3. kupo777 👍 2 Answered B
    A: Since only all alerts are captured, the requirement to capture all traffic logs cannot be met. B: The Network Firewall log settings are configured for logging from the Network Firewall's Firewall Details screen. When configuring the logging settings, select either the alert log or the traffic log, or both, and configure the output settings. C: The requirement is not met because alerts cannot be captured. D: Network Firewall alerts and traffic logs cannot be captured by CloudTrail.
  4. daemon101 👍 2 Answered A
    logging destinations are s3, cloudwatch, or data firehose https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-logging-destinations.html
  5. JoellaLi 👍 1 Answered D
    AWS Network Firewall is integrated with AWS CloudTrail, a service that provides a record of API calls to Network Firewall by a user, role, or an AWS service. CloudTrail captures all API calls for Network Firewall as events. The calls captured include calls from the Network Firewall console and code calls to the Network Firewall API operations. If you create a trail, you can enable continuous delivery of CloudTrail events to an Amazon S3 bucket, including events for Network Firewall. If you don't configure a trail, you can still view the most recent events in the CloudTrail console in Event history. Using the information collected by CloudTrail, you can determine information including the request that was made to Network Firewall, the IP address from which the request was made, who made the request, and when the request was made.
Show 2 more comments
  1. KobDragoon 👍 1 Answered B
    B - is the only Answer that correctly mentions both alert logs and flowlogs which are 2 different log types the network firewall can be configured to log. A - seems like a good answer as it mentions sending the logs to a cloudwatch log group, but where the logs are sent is not part of the question and so as A only mentions alert logs, it's incorrect.
  2. qomtodie 👍 1 Answered A
    Only 3 systems can have AWS Network Firewall Log. Amazon Simple Storage Service, Amazon CloudWatch Logs, Amazon Data Firehose.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

What is the most secure way to expose cross-account microservices with API Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide