A cloud security team investigating suspected data exfiltration reviews the virtual network flow logs for a compromised workload. The logs show the source, destination, ports, protocol and byte counts of a suspicious session, but the analysts need to see what was actually transmitted. Which capability would have provided that content?
Select an answer to reveal the explanation.
Short Explanation
Think of flow logs as the envelope, not the letter: you get who talked to whom, on which port, and how much, but never what was said. If you need the payload, you need packet capture or traffic mirroring running before the event. The trap is thinking more flow logging, longer or denser, eventually turns into content. It never does.
Full Explanation
Flow logs in a virtual network are connection metadata: source and destination addresses, ports, protocol, packet and byte counts, timestamps and the accept or reject decision. They are excellent for spotting unusual destinations or volumes, but they contain no payload. To see what was actually transmitted, the environment needs full packet capture, usually delivered in the cloud through a traffic mirroring feature or a capture agent on the workload, sending copies of packets to an analysis tool. Keeping flow logs for longer only preserves the same metadata for more time; retention changes how far back analysts can look, not what each record contains. Raising a sampling rate makes the metadata more complete, but a header-level record still carries no application data. Logging denied connections adds visibility into blocked attempts, yet the exfiltration session was allowed, and a filtering rule never inspects or stores content. Exam caveat: packet capture is costly and generates sensitive data of its own, so it is normally targeted at high-value segments or enabled during an investigation rather than everywhere. Operational check: confirm which subnets or workloads have mirroring or capture enabled, where captures are stored, who can access them, and that the capture storage is itself encrypted and retained under the evidence-handling policy.