Which AWS Service Captures Inbound and Outbound VPC Traffic?
Which AWS service or tool can be used to capture information about inbound and outbound traffic in an Amazon VPC?
Community Insight
The question tests which native VPC feature records inbound and outbound traffic metadata; the trap is confusing traffic capture with vulnerability scanning, private endpoint connectivity, or NAT address translation.
VPC Flow Logs capture IP traffic metadata for network interfaces in an Amazon VPC, giving visibility for troubleshooting, security analysis, and compliance checks. This page confirms VPC Flow Logs (A) as the correct answer over Amazon Inspector, VPC endpoint services, and NAT gateway.
Learners often choose Amazon Inspector because it sounds like a network monitoring tool, but Inspector assesses EC2 instances and container images for vulnerabilities rather than capturing VPC traffic flows.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
VPC Flow Logs is the AWS feature designed to capture information about IP traffic going to and from network interfaces in an Amazon VPC. It can be enabled at the VPC, subnet, or elastic network interface level and records metadata such as source and destination IP addresses, ports, protocol, and whether traffic was accepted or rejected. The logs can be published to Amazon CloudWatch Logs, Amazon S3, or Amazon Data Firehose for analysis and retention. This directly matches the question's requirement to capture inbound and outbound traffic information in a VPC, making VPC Flow Logs the correct choice.Why the Other Options Are Wrong
Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure; it does not provide VPC flow records. VPC endpoint services, typically associated with AWS PrivateLink, enable private connectivity to supported AWS services or endpoint services, but they are not a traffic-capture tool. A NAT gateway provides outbound internet connectivity for private subnet resources and performs address translation; its primary role is connectivity, not capturing inbound and outbound VPC traffic metadata. VPC Flow Logs is the dedicated observability feature for the traffic information described in the question.Community Comment Notes
fguglia and xxjbloxx both selected A, with xxjbloxx describing VPC Flow Logs as a built-in feature that captures "detailed network information about the IP traffic" for troubleshooting and security compliance. Ruffyit and petercorn pointed to the official AWS VPC Flow Logs documentation, reinforcing that the answer comes from vendor documentation rather than guesswork. The community consensus aligns with the technical reading of the question: the service that records traffic flow metadata in a VPC is VPC Flow Logs.Official Reference
Exam Strategy
When a question asks about capturing traffic in a VPC, look for VPC Flow Logs rather than security scanning, endpoint connectivity, or NAT translation. Remember that Flow Logs record metadata, not packet payloads, so they are not a replacement for deep packet inspection.
Frequently Asked Questions
Why is Amazon Inspector not the tool for capturing VPC traffic?
Inspector scans EC2 instances and container images for vulnerabilities; it does not record inbound and outbound VPC flow metadata.
Do VPC Flow Logs capture packet payloads?
No. Flow Logs record metadata such as source/destination IP, ports, protocol, and accept/reject status, not the actual packet contents.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →