SOA-C02 · Question #516
A SysOps administrator configured VPC flow logs by using the default format. The SysOps administrator specified Amazon CloudWatch Logs as the destination. This solution has worked successfully for…
The correct answer is A. Create a new flow log. Include the tcp-flags field in the custom log format. Delete the original flow. tcp-flags are not included into default format. If you want to have tcp-flags, you should use custom log format. You can't modify existing flow log. https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html
Question
A SysOps administrator configured VPC flow logs by using the default format. The SysOps administrator specified Amazon CloudWatch Logs as the destination. This solution has worked successfully for several months. However, because of additional troubleshooting requirements, the SysOps administrator needs to include the tcp-flags field on the flow logs. What should the SysOps administrator do to meet this requirement?
Options
- ACreate a new flow log. Include the tcp-flags field in the custom log format. Delete the original flow
- BIn the CloudWatch Logs log group, modify the filter to include the tcp-flags field and the type field.
- CIn CloudWatch Metrics, modify the metric configuration to include the tcp-flags field.
- DModify the existing flow log. Include the tcp-flags field and the type field in the custom log format.
How the community answered
(48 responses)- A75% (36)
- B4% (2)
- C8% (4)
- D13% (6)
Explanation
tcp-flags are not included into default format. If you want to have tcp-flags, you should use custom log format. You can't modify existing flow log. https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html
Topics
Community Discussion
No community discussion yet for this question.