You have the following Shared VPC design. VPC Flow Logs is configured for Subnet-1 in the host VPC. You also want to monitor flow logs for Subnet-2. What should you do?

Question

Exhibit

Options

• AConfigure a VPC Flow Logs filter for Subnet-2 in the host project VPC.
• BConfigure VPC Flow Logs in the service project VPC for Subnet-2.
• CConfigure Packet Mirroring in both the host and service project VPCs.
• DConfigure a firewall rule to permit Subnet-2 IP addresses outbound in the host project VPC.

• A
  87% (53)
• B
  7% (4)
• C
  5% (3)
• D
  2% (1)

Explanation

In a Shared VPC, all subnets physically reside in the host project's VPC - service projects borrow access to those subnets but don't own them. Because VPC Flow Logs is a subnet-level configuration, it must be enabled (or filtered) from the host project, making A correct: you simply configure Flow Logs on Subnet-2 within the host project VPC, exactly as was done for Subnet-1.

B is wrong because service projects have no VPC of their own for shared subnets - there's nothing to configure Flow Logs on in the service project. C is wrong because Packet Mirroring is a traffic inspection/security tool, not a flow log mechanism, and the scenario calls for flow log monitoring specifically. D is wrong because firewall rules govern traffic allowance, not observability - they have no bearing on whether Flow Logs captures traffic data.

Memory tip: Think "subnets live in the host." Anything subnet-level (Flow Logs, firewall rules, subnet settings) is always managed in the host project, no matter which service project's VMs are using that subnet.

No community discussion yet for this question.