Which AWS Service Captures Inbound and Outbound VPC Traffic?
Short answer
A VPC Flow Logs captures metadata about inbound and outbound IP traffic for network interfaces in an Amazon VPC.
Question
Key Takeaways
The question tests which native VPC feature records inbound and outbound traffic metadata; the trap is confusing traffic capture with vulnerability scanning, private endpoint connectivity, or NAT address translation.
VPC Flow Logs capture IP traffic metadata for network interfaces in an Amazon VPC, giving visibility for troubleshooting, security analysis, and compliance checks. This page confirms VPC Flow Logs (A) as the correct answer over Amazon Inspector, VPC endpoint services, and NAT gateway.
Common mistake: Learners often choose Amazon Inspector because it sounds like a network monitoring tool, but Inspector assesses EC2 instances and container images for vulnerabilities rather than capturing VPC traffic flows.
Expert Analysis
Why the Answer Is Correct
VPC Flow Logs is the AWS feature designed to capture information about IP traffic going to and from network interfaces in an Amazon VPC. It can be enabled at the VPC, subnet, or elastic network interface level and records metadata such as source and destination IP addresses, ports, protocol, and whether traffic was accepted or rejected. The logs can be published to Amazon CloudWatch Logs, Amazon S3, or Amazon Data Firehose for analysis and retention. This directly matches the question's requirement to capture inbound and outbound traffic information in a VPC, making VPC Flow Logs the correct choice.
Why the Other Options Are Wrong
Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure; it does not provide VPC flow records. VPC endpoint services, typically associated with AWS PrivateLink, enable private connectivity to supported AWS services or endpoint services, but they are not a traffic-capture tool. A NAT gateway provides outbound internet connectivity for private subnet resources and performs address translation; its primary role is connectivity, not capturing inbound and outbound VPC traffic metadata. VPC Flow Logs is the dedicated observability feature for the traffic information described in the question.
Community Comment Notes
fguglia and xxjbloxx both selected A, with xxjbloxx describing VPC Flow Logs as a built-in feature that captures "detailed network information about the IP traffic" for troubleshooting and security compliance. Ruffyit and petercorn pointed to the official AWS VPC Flow Logs documentation, reinforcing that the answer comes from vendor documentation rather than guesswork. The community consensus aligns with the technical reading of the question: the service that records traffic flow metadata in a VPC is VPC Flow Logs.
Official Reference
https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a question asks about capturing traffic in a VPC, look for VPC Flow Logs rather than security scanning, endpoint connectivity, or NAT translation. Remember that Flow Logs record metadata, not packet payloads, so they are not a replacement for deep packet inspection.
Frequently Asked Questions
Why is Amazon Inspector not the tool for capturing VPC traffic?
Do VPC Flow Logs capture packet payloads?
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
fguglia 👍 2 Answered AA is correct!
-
xxjbloxx 👍 1 Answered AVPC Flow Logs is the correct choice:Traffic Capture: VPC Flow Logs is a built-in feature that enables you to capture detailed network information about the IP traffic going to and from network interfaces inside your Amazon VPC.Troubleshooting and Security: It monitors connectivity, tracks down configuration errors, and ensures security compliance by recording metadata like source/destination IP addresses, ports, protocol numbers, packet counts, and whether the traffic was accepted or rejected by security groups/NACLs.
-
Ruffyit 👍 1https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html
-
kcris10 👍 1A. VPC Flow Logs
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →