Exam AWS Certified SysOps Administrator - Associate topic 1 question 150 discussion

Ans: A You CANNOT modify a VPC Flow Log Ref: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html#flow-logs-limitations "After you create a flow log, you cannot change its configuration or the flow log record format. For example, you can't associate a different IAM role with the flow log, or add or remove fields in the flow log record. Instead, you can delete the flow log and create a new one with the required configuration."

I think the answer is A. Flow logs basics: You can create a flow log for a VPC, a subnet, or a network interface. If you create a flow log for a subnet or VPC, each network interface in that subnet or VPC is monitored. Flow log data for a monitored network interface is recorded as flow log records, which are log events consisting of fields that describe the traffic flow. For more information, see Flow log records. To create a flow log, you specify: The resource for which to create the flow log. The type of traffic to capture (accepted traffic, rejected traffic, or all traffic). The destinations to which you want to publish the flow log data. https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html

After you create a flow log, you cannot change its configuration or the flow log record format. For example, you can't associate a different IAM role with the flow log, or add or remove fields in the flow log record. Instead, you can delete the flow log and create a new one with the required configuration.

Flow logs can help you with a number of tasks, such as: Diagnosing overly restrictive security group rules Monitoring the traffic that is reaching your instance Determining the direction of the traffic to and from the network interfaces Flow log data is collected outside of the path of your network traffic, and therefore does not affect network throughput or latency. You can create or delete flow logs without any risk of impact to network performance.

Answer: A

A - you can't modify an existing flow log. Also it's not B since we want to log all traffic.

Ans A You cannot modify VPC Flow Log just tested it.

Keyword: "ensure that all traffic is logged"

The answer is: B. Create a new flow log. Set the log record format to a custom format. Select the proper fields to include in the log. You need to create a new flow log. There is no "filter setting to capture all traffic", but you can set the log record to a custom format as specified in the user guide (https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html#flow-logs-custom)

Ans: A