VPC Flow Logs Analysis Quiz

What you'll be asked

1. What is the primary purpose of VPC Flow Logs in a cloud environment?
2. When analyzing VPC Flow Logs to identify a potential port scan, which field would be most useful to aggregate?
3. You notice a high volume of 'REJECT' actions in your VPC Flow Logs for a specific instance. What is the most likely cause?
4. Which of the following is a limitation of standard VPC Flow Logs that an analyst must consider?
5. You are investigating a potential data exfiltration event. You have a Flow Log entry with a large 'bytes' value and a 'REJECT' status. What does this indicate?

Answers and explanations come after you submit.