How Do You Detect Unsolicited Inbound Traffic in NAT Gateway Flow Logs?
Short answer
D Use CloudWatch Logs to query NAT gateway and instance ENIs for dstAddr like 198.51.100.2 and srcAddr like 203.0 to check whether the VPC initiated the flow.
Question
A solutions architect must determine whether the traffic represents unsolicited inbound connections from the internet. The first two octets of the VPC CIDR block are 203.0.
Which set of steps should the solutions architect take to meet these requirements?
Key Takeaways
Testing whether NAT gateway inbound traffic is unsolicited requires finding the corresponding outbound flow from the VPC CIDR to the public IP; the trap is re-querying the already-visible inbound record (option B) or using CloudTrail instead of CloudWatch Logs.
VPC Flow Logs for a NAT gateway are analyzed in Amazon CloudWatch Logs, not CloudTrail, to determine whether inbound traffic from 198.51.100.2 was solicited. The page establishes that option D is correct because it queries the reverse flow from the 203.0 VPC CIDR back to the public IP to see whether the instance initiated the connection.
Common mistake: The most common wrong choice is B: it opens CloudWatch and filters on the exact inbound tuple already observed, but that only restates the suspicious traffic and cannot prove whether the VPC contacted 198.51.100.2 first.
Expert Analysis
Why the Answer Is Correct
Option D is the only choice that both uses the correct log destination and checks the direction needed to answer the question. VPC Flow Logs are stored in Amazon CloudWatch Logs, so the architect should open the CloudWatch console, select the log group for the NAT gateway ENI and the private EC2 ENI, and query for dstAddr like 198.51.100.2 with srcAddr like 203.0. If that reverse flow exists before the inbound ACCEPT record, the traffic is a response to an outbound connection initiated by the VPC; if it does not exist, the inbound connection is more likely unsolicited. The stats command summing bytes by srcAddr and dstAddr is the documented way to compare the two directions.
Why the Other Options Are Wrong
Options A and C send the architect to AWS CloudTrail, which records API activity and cannot contain NAT gateway packet-flow records; that alone eliminates them. Options B and D correctly use CloudWatch, but B filters with destination 203.0 and source 198.51.100.2, which is the same inbound record the company already sees. B can confirm that the traffic exists, but it cannot show whether the VPC contacted 198.51.100.2 first, so it does not resolve the "unsolicited" question. C also reverses the useful direction and uses CloudTrail.
Community Comment Notes
Several learners were split between B and D. Maria2023 initially chose B but changed to D because the word "unsolicited" requires checking "if it's a return traffic, requested by a machine in the VPC"; cox1960 made the same point, saying B is what the company already sees and D is needed "to see if it was first initiated from EC2". johnballs221 similarly said the goal is to check whether the inbound flow is a response to an outbound connection. The B-leaning comments, such as kiran15789's query using dstAddr like the VPC prefix and srcAddr like the public IP, describe the visible inbound record but do not establish whether the connection was solicited.
Official Reference
- https://aws.amazon.com/premiumsupport/knowledge-center/vpc-analyze-inbound-traffic-nat-gateway/
- https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html
These links open the official vendor documentation in a new tab.
Exam Strategy
Eliminate CloudTrail immediately whenever the stem asks about VPC Flow Logs or packet-level traffic, because CloudTrail records AWS API calls, not flow records. Then decide which direction of the flow proves the point: for unsolicited inbound, look for the VPC-initiated outbound flow, not the inbound record that prompted the investigation.
Frequently Asked Questions
Why is CloudTrail wrong for analyzing NAT gateway flow logs?
Why query dstAddr like 198.51.100.2 instead of the inbound record already seen?
Discussion 74 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 30 of 74
-
kiran15789 👍 23 Answered Bhttps://aws.amazon.com/premiumsupport/knowledge-center/vpc-analyze-inbound-traffic-nat-gateway/ Refer Reason 1 Run the query below. filter (dstAddr like 'xxx.xxx' and srcAddr like 'public IP') | stats sum(bytes) as bytesTransferred by srcAddr, dstAddr | limit 10 Note: You can use just the first two octets in the search filter to analyze all network interfaces in the VPC. In the example above, replace xxx.xxx with the first two octets of your VPC classless inter-domain routing (CIDR). Also, replace public IP with the public IP that you're seeing in the VPC flow log entry. Query results show traffic on the NAT gateway private IP from the public IP, but not traffic on other private IPs in the VPC. These results confirm that the incoming traffic was unsolicited. However, if you do see traffic on the private instance's IP, then follow the steps under Reason #2.
-
vsk12 👍 23I would go with option B. Source will be public IP like 198.51.100.2.
-
papan83 👍 7 Answered DStep-by-Step Approach: You already have this log entry: srcaddr = 198.51.100.2 dstaddr = 203.0.x.x action = ACCEPT Now, query CloudWatch Logs for the reverse flow: srcaddr = 203.0.x.x (your EC2 instance) dstaddr = 198.51.100.2 (the public IP) If you find outbound traffic from your instance to the public IP before the inbound traffic, then the connection is solicited (i.e. it's a reply). If you do not find any outbound flow to that public IP, then the traffic is unsolicited — a potentially unexpected or malicious inbound attempt that should have been blocked.
-
Maria2023 👍 7 Answered DInitially I went for B but when I saw the answer and read the documentation I am going for D due to the word "unsolicited" traffic. That for me means that we need to check if it's a return traffic, requested by a machine in the VPC. So we check whether any instance called that IP. B would more be for the associate exam
-
hexie 👍 6 Answered BB. No clue of why you guys that voted D are convinced. Destination will be your VPC octets, source is the IP that is making the requests.
Show 25 more comments
-
masetromain 👍 5 Answered DThe correct answer is D. Open the Amazon CloudWatch console. Select the log group that contains the NAT gateway's elastic network interface and the private instance's elastic network interface. Run a query to filter with the destination address set as "like 198.51.100.2" and the source address set as "like 203.0". Run the stats command to filter the sum of bytes transferred by the source address and the destination address. This set of steps will allow the solutions architect to determine whether the inbound traffic coming from the public IP address 198.51.100.2 is unsolicited, by filtering the VPC flow logs to show the traffic that is going to the private Amazon EC2 instance, and then checking if the traffic is coming from within the VPC CIDR block (203.0) or from outside of it (198.51.100.2). By using Amazon CloudWatch and filtering the logs with the specified IP addresses, the architect can quickly and efficiently identify any unsolicited traffic.
-
mfsec 👍 5 Answered BOption B is better than option D because it filters the logs based on the source address "like 198.51.100.2" (the public IP address) and the destination address "like 203.0" (which corresponds to the VPC CIDR block). By analyzing the traffic between these addresses, you can determine whether the traffic represents unsolicited inbound connections from the internet.
-
Maria2023 👍 5I have the feeling that this question is missing the "Choose 2" option. Ideally, I would run both queries (B and D) to see if the outbound matches the inbound
-
cox1960 👍 5B is what "the company is seeing", so D to see if it was first initiated from EC2.
-
sashenka 👍 3 Answered DWhy Option B is Problematic: // Example CloudWatch Logs Insights Query for Option B fields @timestamp, sourceAddress, destinationAddress, action, bytes | filter destinationAddress like "203.0" | filter sourceAddress like "198.51.100.2" | stats sum(bytes) by sourceAddress, destinationAddress 1. Incorrect Traffic Direction - It looks for traffic where source = 198.51.100.2 (internet) and destination = 203.0.x.x (VPC) This only shows successful inbound connections (ACCEPT) It doesn't reveal whether these connections were solicited or unsolicited 2. Missing Context - Doesn't show the initial outbound connection that would indicate a solicited response - Cannot differentiate between legitimate responses and actual unsolicited connections - Lacks the temporal relationship between outbound and inbound flows
-
zejou1 👍 3 Answered BB is the better option -> we need to understand why and which IPs this is hitting. If it is being allowed through, then we can identify the actual Private internal VPC that may have a bad inbound security group allowing connectivity. Once that is identified, we could reverse (or add an 'or') to see all inbound and outbound traffic between the two. Identify the actual flow first before flipping it hence statement: Query results show traffic on the NAT gateway private IP from the public IP, but not traffic on other private IPs in the VPC. These results confirm that the incoming traffic was unsolicited. However, if you do see traffic on the private instance's IP, then follow the steps under Reason #2. (this is more security analytics/traffic log review)
-
youonebe 👍 3Correct answer is D. This is for NAT traffic analysis, so the focus is outbound. VPC Flow Logs are published to CloudWatch Logs, not CloudTrail1. This immediately eliminates options A and C. To determine if the traffic is unsolicited inbound connections: We need to check if the private EC2 instance (starting with 203.0) initiated the connection to 198.51.100.2 If the source IP is from the VPC (203.0) and the destination is 198.51.100.2, this indicates the connection was initiated from inside the VPC This would mean the ACCEPT traffic is a response to an outbound request, not unsolicited inbound traffic.
-
ajeeshb 👍 3 Answered DThe question is "Solutions architect must determine whether the traffic represents unsolicited inbound connections from the internet". The NAT gateway does not allow any inbound traffic from an internet other than response to a traffic it sent out to internet which came from a VPC resource (eg, EC2). So to find out if the inbound traffic to NAT Gateway from internet IP 198.51.100.2 is unsolicit or not, check the vpc flowlog to see if there was an original request from source IP 203.0 to destination 198.51.100.2. This is what option D says.
-
ZK000001qws 👍 3 Answered BThe ask is "A solutions architect must determine whether the traffic represents unsolicited inbound connections from the internet". inbound connections from the internet - if we are to check the inbound connection, wouldn't the source be internet IP and destination be VPC? Thus I choose B too. If it was outbound, initiated from VPC then it would make sense for D.
-
Untamables 👍 3 Answered DThis is a trick question. 'Action = ACCEPT' response is sent from private EC2 instances (203.0.x.x) to the public IP address (198.51.100.2) via the NAT Gateway. The NAT Gateway can catch only this outbound traffic because the relevant inbound traffic does not pass through the NAT Gateway.
-
Vongolatt 👍 3 Answered Dthe solution architect want to check if it's unsolicited traffic or not, so we need to check the if the request is sent by us. which means 198.51.100.2 should be the destination.
-
NikkyDicky 👍 3 Answered DD. see filter expression in https://repost.aws/knowledge-center/vpc-analyze-inbound-traffic-nat-gateway, reason #2
-
getsat0024 👍 3It is B Reference:https://aws.amazon.com/premiumsupport/knowledge-center/vpc-analyze-inbound-traffic-nat-gateway/
-
moota 👍 3 Answered DTrick question. A NAT Gateway is not supposed to accept incoming traffic. There might be a security issue here.
-
master9 👍 3 Answered DAction = ACCEPT for inbound traffic that comes from public IP address 198.51.100.2 --> Destination
-
sammyhaj 👍 3D, we need to see if the internal origin was first used
-
severlight 👍 3 Answered Bsee kiran15789's answer
-
study_aws1 👍 2I was inclined towards Reason #2 in https://repost.aws/knowledge-center/vpc-analyze-inbound-traffic-nat-gateway. However, the striking point is the VPC CIDR 203.0.... which is not a private addressing and not sure if we require a NAT gateway here at all for translation & check if the traffic was initiated through NAT gateway. Does the definition of unsolicited connection means any inbound connection other than the traffic initiated from VPC via NAT gateway will not be considered as solicited. Tough one from the unclear definition in the question, it would be Reason 1 (Option B) if the traffic is mentioned as dropped in the question but needs to be analyzed for whether this is unsolicited. Or if question states inbound traffic is not permitted, but still it is seen and needs to be analyzed then D). Again, point to be noted is why outbound traffic from '203.0...' needs to go via NAT gateway.
-
sashenka 👍 2Better Approach (Option D) sql // Example CloudWatch Logs Insights Query for Option D fields @timestamp, sourceAddress, destinationAddress, action, bytes | filter sourceAddress like "203.0" | filter destinationAddress like "198.51.100.2" | stats sum(bytes) by sourceAddress, destinationAddress This query would: Show outbound traffic from VPC to the internet Help establish if the private instance initiated communication Allow correlation between outbound requests and inbound responses Key Concept With NAT gateway connections: Legitimate traffic follows a request-response pattern Outbound request must exist before inbound response Looking only at inbound traffic (Option B) misses this crucial relationship Therefore, Option D provides the necessary visibility to determine if the inbound connections were truly unsolicited by examining the outbound traffic first.
-
bjexamprep 👍 2I would say this question is wrong, even we ignore the 203.0 is a public IP. Both B and D can do the job. With B: if the return value is bigger than 0, that means the traffic was initiated from internal so that NAT GW wouldn't drop that traffic. While, if the return is 0, that means the traffic was dropped by NAT after ACCEPTed, which means it was not initiated from internal. With D: if the return value is bigger than 0, obviously the traffic was initiated from internal. If the return value is 0, that means the traffic was initiated from internet.
-
8608f25 👍 2 Answered BOption B is correct because VPC flow logs are stored in Amazon CloudWatch Logs. Analyzing these logs in CloudWatch allows you to filter and examine specific traffic patterns, such as traffic coming from a public IP address to a private instance. The query specified in this option correctly aims to identify traffic from the public IP (198.51.100.2) to the private IP range of the VPC (beginning with 203.0), which aligns with the requirement to investigate unsolicited inbound connections.
-
ggrodskiy 👍 2Correct D. You need to open the Amazon CloudWatch console, select the log group that contains the NAT gateway's elastic network interface and the private instance's elastic network interface, run a query to filter with the destination address set as "like 198.51.100.2" and the source address set as "like 203.0", and run the stats command to filter the sum of bytes transferred by the source address and the destination address.
-
BennyMao 👍 2 Answered DThe NAT gateway allows outbound internet traffic from private instances but does not accept unsolicited inbound connections. If 198.51.100.2 is contacting the private instance, we need to determine if this is a response to an existing outbound request from the private instance.
-
masetromain 👍 2The other options are not correct because they are not using the correct service (CloudTrail instead of CloudWatch) or not filtering the logs correctly with the specified IP addresses and the desired information is not available.
-
mns0173 👍 2Of course it is D. What useful info will you get from B? You need to check original request which in case of NAT is always EC2, not something in the internet.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SAP-C02 Questions
Access 85 questions with complete answers and detailed explanations.
View Full SAP-C02 Practice Test →