Exam AWS Certified Advanced Networking - Specialty ANS-C01 topic 1 question 8 discussion

A. Yes, this would work. B. Not a real thing, wrong C. We don't need to do packet inspection to analyze costs. This won't help with costs at all. D. The most obvious right answer. E. Like B, not a real thing.

NAT gateways do not have their own elastic network interfaces (ENIs) . In such A & D is not correct hence it should be

A and C are the best answers based on the requirements

C -- also working answer. In Wireshark you can generate reports for traffic usage.

AD seem to be the correct answers. Enabling "NAT gateway access logs" is not a valid feature.

I think that it's answer is AD according to SPOTO products.

https://repost.aws/knowledge-center/vpc-find-traffic-sources-nat-gateway Check this re:Post, it seems like A-E

A and D - you can only enable VPC flow logs on ENIs rather than on the services in that case NAT Gateway

A & D are the real answer

Went with A,D given that we want to track which IPs are source of the problem. given that NAT gateway access logs only provide information about connections that are initiated by the NAT gateway. VPC flow logs provide more detailed information about the traffic that passes through the NAT gateway.

Selected Answer: AD

Overall, Options A and B are the most relevant and efficient approaches to investigate the traffic through the NAT gateway and identify the source of increased NAT gateway usage. Although also C and D are correct, but we do not want deeper analysis of the logs. Again remember, both VPC flow logs and NAT gateway access logs can provide network information about the traffic going through the NAT gateway.

packet captures will require inspection per TCP connection, which is not reasonable, so - A&D

These are correct

my guess was not entirely correct. i am leaning towards to A, B and D, Option D is also a valid approach to investigate the traffic through the NAT gateway. By enabling VPC flow logs on the NAT gateway's elastic network interface and publishing the logs to an S3 bucket, a network engineer can create a custom table for the S3 bucket in Amazon Athena to describe the log structure and use Athena to query and analyze the logs. This approach provides a lot of flexibility in terms of data analysis and long-term storage of the log data. So, technically, options A, B, and D are all valid ways to investigate NAT gateway usage. However, options A and B are probably more efficient because they allow you to query and analyze the logs directly in CloudWatch Logs without having to set up additional infrastructure. so either - AB or AD

Could not find any link that states any details around NAT Gateway access logs. I found the below link with exact same problem statement with options for resolution asked (in this case A and D) https://aws.amazon.com/premiumsupport/knowledge-center/vpc-find-traffic-sources-nat-gateway/

A,D https://aws.amazon.com/premiumsupport/knowledge-center/vpc-find-traffic-sources-nat-gateway/