To meet security compliance of the company, your manager asks you to configure VPC Flow Logs in all AWS accounts. You create the flow logs in VPCs and use an S3 bucket to store the logs. You also set up a Sumo Logic dashboard to help analyze the log data. Which of the following information can you get from the VPC Flow Logs? (Select TWO.)

Answer options:

A.The time when the messages in an SQS queue reach the limit.
B.The time of the day when your EC2 hosted web application experiences the heaviest load.
C.The time when EC2 instances raise customized CloudWatch alarms.
D.The number of objects that are written to S3 buckets owned by your AWS accounts.
E.The geographic region that has the most users for your application.

Correct Answer – B, E
VPC Flow Logs capture information about the IP traffic going to and from network interfaces in the VPC. About the available fields in the Flow Logs records, please check https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html.
Option A is incorrect: VPC Flow Logs can capture information such as source/destination IP addresses and ports. The logs cannot capture the information of messages in an SQS queue.
Option B is CORRECT: Because by analyzing the IP traffic from the Flow Logs, users can get the load information and understand when an application has the most number of requests.
Option C is incorrect: VPC Flow Logs cannot reflect the time when CloudWatch customized alarms are raised in EC2 instances.
Option D is incorrect: VPC Flow Logs collect IP traffic in network interfaces of AWS services. However the AWS S3 information is not collected by VPC Flow Logs.
Option E is CORRECT: Because VPC Flow Logs can collect the source addresses of incoming traffic. Users can get the geographic information from the requests.