A municipal security operations center needs flow-level visibility of east-west traffic across Transit Gateway attachments to investigate anomalous paths between department VPCs. Which monitoring approach best supports this investigation?
Select an answer to reveal the explanation.
Short Explanation
When east-west traffic goes weird, you need a flight recorder—not a spreadsheet of last month's spend. Transit Gateway and VPC Flow Logs show who talked to whom across attachments. Turning logging off to save pennies makes investigations guesswork.
Full Explanation
A municipal SOC investigating anomalous east-west paths across Transit Gateway attachments needs flow-level telemetry, not monthly slideware. Enabling Transit Gateway Flow Logs—and VPC Flow Logs where subnet or ENI detail is required—and delivering those records to a centralized logging account gives analysts who-talked-to-whom visibility across department VPC attachments. That evidence supports incident response when a sandbox route suddenly appears toward courts or when unexpected ports traverse shared networking.
Disabling all flow logging to save cost and relying only on monthly architecture reviews leaves the SOC blind during the hours that matter; reviews cannot reconstruct ephemeral east-west flows after the fact. Inspecting traffic solely with public internet packet captures outside AWS misunderstands the problem: TGW east-west traffic often never hits the public internet, and AWS does provide TGW and VPC flow logging for exactly this use case. Cost Explorer daily granularity reports explain spend, not packet paths, and cannot substitute for network flow telemetry.
Exam caveat: VPC Flow Logs and Transit Gateway Flow Logs are complementary—use TGW logs for attachment-level east-west across the hub and VPC logs for finer ENI/subnet forensics; Cost Explorer is never a flow source. Operational check: enable TGW Flow Logs to the central bucket or CloudWatch Logs group, generate a known probe between two attachments, confirm log records appear with expected src/dst and action fields, and ensure only the SOC logging account can retain and query the streams.