nerdexam
Amazon

ANS-C01 · Question #263

A network engineer needs to provide a list of IP addresses that are sending traffic to an Amazon EC2 instance. VPC flow logs are enabled. The EC2 instance has a single network interface and two assign

The correct answer is A. Create a new flow log that includes the pkt-dstaddr field to capture the original destination IP. To identify traffic directed at a secondary IP address on an EC2 instance when default VPC flow logs only show the primary IP, the network engineer must configure a new flow log that includes the pkt-dstaddr field.

Submitted by femi9· Mar 6, 2026Network Management and Operation

Question

A network engineer needs to provide a list of IP addresses that are sending traffic to an Amazon EC2 instance. VPC flow logs are enabled. The EC2 instance has a single network interface and two assigned IP addresses. However, the flow logs are logging traffic only for the primary IP address. The network engineer needs to determine whether any traffic is being sent to the second IP address of the EC2 instance. What should the network engineer do to locate the traffic flow for the second IP address?

Options

  • ACreate a new flow log that includes the pkt-dstaddr field to capture the original destination IP
  • BCreate a new flow log that includes the dstaddr field to capture the original destination IP address
  • CCreate a new flow log that includes the pkt-srcaddr field to capture the original destination IP
  • DCreate a new flow log that includes the srcaddr field to capture the original destination IP address

How the community answered

(33 responses)
  • A
    82% (27)
  • B
    6% (2)
  • C
    3% (1)
  • D
    9% (3)

Why each option

To identify traffic directed at a secondary IP address on an EC2 instance when default VPC flow logs only show the primary IP, the network engineer must configure a new flow log that includes the `pkt-dstaddr` field.

ACreate a new flow log that includes the pkt-dstaddr field to capture the original destination IPCorrect

The `pkt-dstaddr` field in VPC Flow Logs captures the original destination IP address of a packet before any network address translation (NAT) occurs, which is crucial for identifying traffic specifically targeting secondary IP addresses on an EC2 instances that might be hidden by `dstaddr`.

BCreate a new flow log that includes the dstaddr field to capture the original destination IP address

The `dstaddr` field logs the destination IP address of the packet *after* any NAT, which might show the primary IP or a NAT gateway IP, potentially obscuring the original secondary destination IP address.

CCreate a new flow log that includes the pkt-srcaddr field to capture the original destination IP

The `pkt-srcaddr` field captures the original source IP address, not the destination IP address, and is therefore irrelevant for identifying traffic sent *to* the EC2 instance's secondary IP.

DCreate a new flow log that includes the srcaddr field to capture the original destination IP address

The `srcaddr` field captures the source IP address after NAT, not the destination IP address, and is thus not useful for determining traffic reaching the EC2 instance's secondary IP.

Concept tested: VPC Flow Logs fields for original destination IP

Source: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html#flow-log-fields

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full ANS-C01 Practice