Why Does VPC Traffic Mirroring Randomly Drop Traffic?

ANS-C01 By islever Editorial Last updated

Short answer

DE The mirrored traffic has a lower priority than the production traffic and is being dropped when network congestion occurs. The NLB is experiencing warm-up delay because of sudden and significant increases in traffic.

Question

A financial company offers investment forecasts and recommendations to authorized users through the internet. All the services are hosted in the AWS Cloud. A new compliance requirement states that all the internet service traffic from any host must be logged and retained for 2 years. In its development AWS accounts, the company has designed, tested, and verified a solution that uses Amazon VPC Traffic Mirroring with a Network Load Balancer (NLB) as the traffic mirror target. While the solution runs in one AWS account, the solution mirrors the traffic to another AWS account. A network engineer notices that not all traffic is mirrored when the solution is deployed into the production environment. The network engineer also notices that this behavior is random. Which statements are possible explanations for why not all the traffic is mirrored? (Choose two.)
  1. The security groups are misconfigured on the production AWS account that hosts the company’s services.
  2. The Amazon EC2 instance that is being monitored cannot handle the extra traffic that Traffic Mirroring has introduced.
  3. The IAM policy that allows the creation of traffic mirror sessions is misconfigured
  4. The mirrored traffic has a lower priority than the production traffic and is being dropped when network congestion occurs. Correct Answer
  5. The NLB is experiencing warm-up delay because of sudden and significant increases in traffic. Correct Answer

Key Takeaways

The exam tests two core limitations of Traffic Mirroring: bandwidth usage on the source instance and best-effort delivery under congestion, with the trap being a distracter about NLB warm-up.

This AWS ANS-C01 question examines why VPC Traffic Mirroring might randomly fail to capture all traffic. The correct answers are B and D, as mirrored traffic consumes source ENI bandwidth and is lower priority during congestion.

Common mistake: Selecting E (NLB warm-up delay) instead of B (EC2 bandwidth) is common because both involve scaling, but AWS documentation only lists source ENI bandwidth and congestion as causes of mirror loss.

Expert Analysis

Why the Answer Is Correct

Options B and D are directly supported by AWS documentation. Traffic Mirroring clones traffic on the source ENI, and this cloned traffic consumes the instance's network bandwidth. If the instance is already near its bandwidth limit, mirrored packets are dropped, causing random gaps in mirroring. Additionally, AWS explicitly states that mirrored traffic is sent with 'best effort' and is dropped during network congestion, which explains random packet loss when congestion varies.

Why the Other Options Are Wrong

A (Security groups) is incorrect because Traffic Mirroring operates at the ENI level and does not depend on security group configuration; misconfigured security groups would block real traffic, not cause random mirror loss. C (IAM policy) would prevent session creation entirely, not random partial mirroring. E (NLB warm-up) is a distracter; while NLBs can briefly scale out during traffic spikes, this is not a documented cause of traffic mirroring drops, and it would affect new connections rather than existing mirrored flows.

Community Comment Notes

Community votes are split 47/47 between DE and BD. Comments referencing the official AWS docs (e.g., comment [1]) support B and D citing the 'Traffic Mirroring Network Limitations' page. Comment [2] explicitly states 'E is wrong—there is no case NLB is experiencing warm-up delay.' Comment [3] also favors B and D, noting that NLB warm-up affects connection handling, not random packet drops. The suggested answer DE appears to be a common incorrect choice based on misinterpreting NLB scaling behavior.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Memorize the official Traffic Mirroring limitations page, focusing on best-effort delivery and source ENI bandwidth. When a question describes random mirroring drops, immediately correlate it with congestion (D) and source instance resource limits (B). Eliminate options that would cause consistent failure (e.g., IAM, security groups) rather than intermittent loss.

Community Votes

DE
50%
BD
50%

50% of anonymous learners picked answer DE. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. luisgu 👍 7
    https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-network-limitations.html#traffic-mirroring-bandwidth
  2. seongheon 👍 4
    Answer is B, D E is wrong. There is no case NLB is experiencing warm-up delay
  3. woorkim 👍 3
    B, D is correct! A. Traffic Mirroring operates at the ENI level and does not depend on security group configurations. This is unlikely to cause random packet drops. C. Since the issue is random and traffic mirroring is partially working, this is not the cause. E. While NLB warm-up delays can occur, they typically affect the ability to handle new connections, not random packet drops.
  4. kupo777 👍 3
    Answer is D, E The following choices can be ruled out because events in which all traffic is not mirrored occur at random. A, C Also, because traffic mirroring is a low priority, The replicated traffic generated by each instance is counted against the total bandwidth available to this instance, and if traffic is delayed, the mirrored traffic is dropped first
  5. dspd 👍 2
    B and D E can not because The NLB is experiencing warm-up delay because of sudden and significant increases in traffic. While NLBs can experience some warm-up delay when there are sudden traffic increases, this is unlikely to be the primary cause of the random mirroring issues. NLBs are designed to handle high volumes of traffic and scale quickly. The warm-up period is typically short and wouldn't explain ongoing random mirroring failures.
Show 4 more comments
  1. Christina666 👍 2
    network congestion can drop the mirror traffic
  2. cas_tori 👍 2
    this is DE
  3. aragon_saa 👍 1
    Answer is A, E
  4. AWSLoverLoverLoverLoverLover 👍 1
    Answer B & D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

What is the most secure way to expose cross-account microservices with API Gateway?

S-grade

How Should Network Engineers Increase Payload Size Through a Transit Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide