A cloud engineer is concerned about command-and-control (C2) communication out of a cloud network over HTTPS. Which of the following should the cloud engineer implement to most efficiently identify…

An Inline IPS (Intrusion Prevention System) is primarily designed for blocking known malicious patterns in real-time rather than efficiently identifying and analyzing novel or custom C2 communication patterns for post-event investigation.

Cloud flow logs (e.g., VPC Flow Logs) capture metadata about IP traffic to and from network interfaces, including source/destination IPs, ports, and protocols. Analyzing these logs can reveal unusual connection patterns or frequent communication with suspicious external IPs over HTTPS, which are strong indicators of C2 activity, without requiring deep packet inspection.

An 'hourly cron listing connections' is a custom, manual, and less scalable approach compared to native cloud flow logs, which are continuously collected and often integrated with log analysis services, and might miss intermittent C2 activity.

Traffic mirroring captures full packet data, which is useful for deep forensic analysis, but it generates a massive amount of data and is not the *most efficient* method for initial identification of C2 patterns, especially considering the scale of cloud networks.