A cloud-first organization deploys workloads in AWS and wants to apply network security monitoring equivalent to on-premises NSM. Which AWS service provides VPC-level network traffic visibility for analysis?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because VPC Flow Logs capture network flow metadata (source IP, destination IP, ports, protocol, bytes, action) for traffic traversing VPC network interfaces, enabling NSM analysis of east-west and north-south traffic patterns equivalent to on-premises NetFlow analysis. A is wrong because CloudTrail logs AWS API calls (management plane) not network traffic flows within the VPC.
Full explanation below image
Full Explanation
B is correct because VPC Flow Logs capture network flow metadata (source IP, destination IP, ports, protocol, bytes, action) for traffic traversing VPC network interfaces, enabling NSM analysis of east-west and north-south traffic patterns equivalent to on-premises NetFlow analysis. A is wrong because CloudTrail logs AWS API calls (management plane) not network traffic flows within the VPC. C is wrong because AWS Config tracks resource configuration changes (security groups, IAM policies) not network traffic flow data. D is wrong because GuardDuty consumes VPC Flow Logs (among other sources) and provides managed anomaly detection, but the question asks for the fundamental visibility service; GuardDuty doesn't work without the underlying flow log data.