You’ve set up VPC Flow logs for your EC2 Instance ENI in a subnet. You can see the below REJECT record in the VPC Flow logs. What does this indicate?
2 123456789911 eni-abc123de 172.31.9.69 172.31.9.12 49761 3389 6 20 4249 1418530010 1418530070 REJECT OK
 

Answer options:

A.Arequest was made on port 80 to the Instance.
B.Someone was trying to log into the instance via SSH.
C.Someone was trying to log into the Instance via RDP.
D.A request was made on port 443 to the Instance.

Answer – C
In the record which is recorded in VPC Flow logs, the highlighted field shown below shows that a request was made to port 3389 which is the RDP protocol.
2 123456789911 eni-abc123de 172.31.9.69 172.31.9.12 49761 3389 6 20 4249 1418530010 1418530070 REJECT OK
There are also other possibilities such as a "port sniffer" that tried to use port 3389 ( for RDP ) or any other application that might have established contact with port 3389 ( using cross-scripting for attacks ). Here `someone` might refer to an individual user ( hacker ) or even other malicious application to gain entry through the backdoor.
By default, all other options become invalid since the log clearly shows what the port number recorded is.
For more information on VPC Flow Logs, one can visit the below URL
https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/flow-logs.html