A company is developing a new application that is deployed in multiple VPCs across multiple AWS Regions. The VPCs are connected through AWS Transit Gateway. The VPCs contain private subnets and…

Question

Options

• AConfigure Network Firewall logging in Amazon CloudWatch to capture all alerts. Send the logs to
• BConfigure Network Firewall logging in Network Firewall to capture all alerts and flow logs.
• CConfigure Network Firewall logging by configuring VPC Flow Logs for the firewall endpoint. Send
• DConfigure Network Firewall logging by configuring AWS CloudTrail to capture data events.

• A
  8% (3)
• B
  73% (27)
• C
  16% (6)
• D
  3% (1)

Explanation

Explanation

Option B is correct because AWS Network Firewall has built-in, native logging capabilities that can capture both alert logs (traffic matching stateful rules that trigger alerts) and flow logs (all network traffic passing through the firewall), which together provide complete visibility for auditing and alerting requirements. This native logging can be sent directly to Amazon S3, CloudWatch Logs, or Kinesis Data Firehose without requiring additional configuration layers.

Why the distractors are wrong:

• Option A is incomplete - CloudWatch alone only captures alerts, not flow logs, so it misses the "completely logged" requirement for all traffic
• Option C is incorrect because VPC Flow Logs capture traffic at the VPC/subnet/ENI level but do not provide firewall-specific deep packet inspection logs or rule-matched alert details that Network Firewall natively provides
• Option D is incorrect because CloudTrail captures API and management events (control plane activity), not actual network traffic data passing through the firewall

Memory Tip

Think of it this way: "Use the tool built for the job." Network Firewall has two logging types - Alert logs (what was flagged) + Flow logs (what passed through) = complete picture. Whenever a question says "completely logged," you need both log types, which only native Network Firewall logging provides in a single configuration.

No community discussion yet for this question.