Study ANS-C01 security validation with VPC Flow Logs, Traffic Mirroring, CloudWatch alarms, CloudTrail, load balancer logs, CloudFront logs, Firewall Manager, and multi-account audit strategy.
Security validation questions on ANS-C01 are about evidence. The exam is not satisfied by “enable logging” as a generic answer. You need to know which AWS signal can see the behavior, how the log is delivered, how it is correlated with other evidence, and how it becomes an alarm or audit finding.
The current AWS task statement is to validate and audit security by using network monitoring and logging services. The official scope includes CloudWatch, CloudTrail, VPC Traffic Mirroring, VPC Flow Logs, Transit Gateway Network Manager, CloudWatch alarms, service log creation, log delivery mechanisms, Firewall Manager, Trusted Advisor, security groups, network ACLs, and multi-account audit strategies.
| Audit decision | What a strong answer checks |
|---|---|
| Evidence source | Which service actually observes the control point: ENI, load balancer, CloudFront edge, route, API call, firewall, or DNS. |
| Evidence detail | Whether flow metadata is enough or packet payload/header inspection is required. |
| Delivery path | CloudWatch Logs, Amazon S3, Kinesis Data Firehose, Kinesis Data Streams, or service-specific delivery. |
| Correlation | How to join network flow, API activity, firewall, load balancer, DNS, and application evidence. |
| Alerting | Which metric, alarm, EventBridge rule, or finding triggers response. |
| Audit coverage | Whether the strategy works across accounts, Regions, VPCs, and future resources. |
The strongest answers connect observation, delivery, analysis, and response.
Use this flow when an answer set mixes log sources, metrics, and audit tools.
flowchart LR
C["Control or requirement"] --> S["Signal source"]
S --> D["Delivery: CloudWatch Logs, S3, Firehose, or Kinesis"]
D --> A["Analysis: Insights, Athena, SIEM, Security Hub, Network Manager"]
A --> R["Response: alarm, finding, ticket, runbook"]
R --> E["Evidence: retained logs, reports, compliance state"]
If an answer collects logs but has no delivery, correlation, alert, or retention path, it is usually incomplete for audit.
| Requirement | Strongest first fit | Why |
|---|---|---|
| Prove accepted or rejected IP flows at ENIs, subnets, or VPCs | VPC Flow Logs | Captures flow-level metadata for network traffic decisions. |
| Analyze Transit Gateway traffic patterns | Transit Gateway Flow Logs and Network Manager | Focuses on central routing domains and topology behavior. |
| Inspect packet contents or feed a packet-analysis appliance | VPC Traffic Mirroring | Mirrors selected ENI traffic for deeper inspection. |
| Track who changed a security group, route table, or firewall policy | CloudTrail | Records AWS API activity and caller identity. |
| Validate HTTP request behavior at the edge | CloudFront logs or WAF logs | Shows edge/web-layer request behavior that VPC Flow Logs cannot see. |
| Validate ALB or NLB access patterns | Load balancer access logs and metrics | Shows client, target, request, TLS, or connection behavior depending on load balancer type. |
| Alert on observed thresholds or patterns | CloudWatch metrics, metric filters, alarms, and EventBridge | Converts log or metric evidence into response. |
| Audit security group posture across accounts | Firewall Manager, AWS Config, Trusted Advisor, and Organizations | Handles policy drift and cross-account consistency. |
Do not pick the deepest signal by reflex. Packet mirroring is powerful, but flow logs are cheaper and simpler when metadata is enough.
VPC Flow Logs are usually the first choice for flow-level security validation.
| Need | Flow log value |
|---|---|
| See whether traffic was accepted or rejected | action helps separate allowed and denied flow records. |
| Identify source and destination | Source/destination address and port fields show the flow tuple. |
| Investigate NAT, load balancer, or service-managed ENI paths | Extended fields can help distinguish packet source/destination from interface-level addresses in some scenarios. |
| Detect unexpected traffic to a subnet or ENI | Flow records can feed CloudWatch Logs Insights, Athena, or SIEM rules. |
| Validate security group or NACL changes | Compare accepted/rejected patterns before and after a control change. |
Flow logs are metadata, not packet capture. They do not show HTTP headers, DNS names inside encrypted traffic, or payload content. They answer “who talked to whom, on which ports, and what was the flow result” more than “what was inside the request.”
ANS-C01 calls out base and extended fields because advanced network questions often involve NAT, load balancers, endpoints, Transit Gateway, and service-managed ENIs.
| Field idea | Why it matters |
|---|---|
| Standard source and destination addresses | Useful for ordinary ENI-level source/destination analysis. |
| Packet source and packet destination fields | Useful when intermediary devices can make interface-level addresses misleading. |
| Flow direction | Helps identify ingress versus egress behavior for the monitored interface. |
| Traffic path fields | Can help reason about whether traffic used a gateway, endpoint, or other path where supported. |
| Region, AZ, subnet, VPC, and instance metadata | Helps correlate the flow to ownership and blast radius. |
The exam trap is assuming a single default field set always proves the path. If the question involves NAT, centralized inspection, load balancers, or endpoints, extended fields may be the stronger answer.
VPC Traffic Mirroring is for deeper inspection when flow metadata is not enough.
| Use Traffic Mirroring when | Avoid it when |
|---|---|
| A security appliance needs packet-level visibility from selected ENIs. | You only need accept/reject flow metadata. |
| You are validating IDS, packet analysis, or detailed protocol behavior. | The source is not eligible for mirroring or the scope is too broad. |
| You can define a narrow filter and target to control volume and cost. | You are trying to replace normal audit logging across an organization. |
| The question asks for packet-level inspection rather than API or metric evidence. | CloudTrail, WAF logs, load balancer logs, or flow logs already answer the question. |
Traffic Mirroring should be targeted. Mirroring everything is rarely the exam answer because it increases cost, noise, and operational risk.
CloudTrail is not a packet log. It is the evidence source for API activity.
| Question clue | Strong evidence |
|---|---|
| “Who opened port 22 to the internet?” | CloudTrail event for the security group rule change, plus current config state. |
| “Which automation changed a route table?” | CloudTrail caller identity, request parameters, and event time. |
| “Did a user disable logging?” | CloudTrail event history or trail evidence. |
| “Is this rule still compliant across accounts?” | AWS Config, Firewall Manager, Trusted Advisor, or Security Hub finding depending on the control. |
| “Was traffic actually denied?” | Flow logs or firewall logs, not CloudTrail alone. |
Use CloudTrail to prove change activity. Use network logs to prove traffic behavior.
Different AWS networking services see different layers of traffic.
| Log source | Best for |
|---|---|
| WAF logs | Web ACL rule matches, allowed/blocked HTTP request patterns, bot or application-layer filtering evidence. |
| CloudFront standard or real-time logs | Edge request behavior, cache/result details, client distribution patterns. |
| ALB access logs | HTTP/HTTPS request behavior at the application load balancer. |
| NLB access logs and metrics | TLS listener and connection-related evidence where supported, plus CloudWatch metrics. |
| Network Firewall logs | Firewall alert and flow evidence from a managed inspection layer. |
| Route 53 Resolver query logs | DNS query visibility from VPC resources. |
| CloudWatch metrics | Time-series signals for alarms, dashboards, and operational thresholds. |
If the issue is an HTTP attack, WAF and ALB/CloudFront logs are more useful than raw VPC flow metadata. If the issue is a rejected TCP connection at a subnet boundary, flow logs are more direct.
ANS-C01 includes log delivery mechanisms because audit architecture fails if logs cannot be collected, retained, searched, and protected.
| Delivery target | Strong use |
|---|---|
| CloudWatch Logs | Near-real-time search, metric filters, alarms, and operational dashboards. |
| Amazon S3 | Durable central retention, Athena analysis, lifecycle policy, and audit archive. |
| Kinesis Data Firehose | Managed delivery pipeline to S3, OpenSearch, third-party destinations, or analytics targets. |
| Kinesis Data Streams | Lower-level streaming when custom consumers need ordered event processing. |
| Central logging account | Multi-account evidence retention with tighter write/read separation. |
For audit, delivery should also include access control, retention, encryption, and protection against easy deletion.
CloudWatch turns evidence into response.
| Need | Pattern |
|---|---|
| Alert when rejected flows spike | Flow logs to CloudWatch Logs, metric filter, CloudWatch alarm. |
| Alert when firewall drops match a rule | Firewall logs or metrics to CloudWatch, alarm or EventBridge rule. |
| Alert when a VPN tunnel is down | CloudWatch metric for tunnel status and alarm. |
| Alert on WAF blocked request surge | WAF metrics, CloudWatch alarm, and investigation runbook. |
| Alert on custom log pattern | Metric filter or embedded metric format depending on the source. |
The exam may ask for customized metrics. The core idea is to transform a log pattern or service metric into an alarmable signal.
Single-account logging patterns do not automatically scale to an organization.
| Audit goal | Strong pattern |
|---|---|
| Centralize logs | Use organization-aware logging and delivery to a central logging or security account. |
| Keep security controls consistent | Use Firewall Manager, Organizations, AWS Config, and delegated administration. |
| Audit security groups | Use Firewall Manager security group policies, AWS Config rules, Trusted Advisor checks, and change logs. |
| Audit NACLs and network controls | Combine configuration snapshots, policy checks, route/security review, and flow evidence. |
| Preserve evidence | Store immutable or tightly controlled logs, retain for the required period, and restrict deletion. |
| Investigate across accounts | Correlate account ID, VPC, subnet, ENI, tag, Region, owner, and change event. |
The exam favors audit designs that keep working when new accounts and VPCs are added.
| Stem clue | Weak answer | Stronger answer |
|---|---|---|
| “Who changed the security group?” | VPC Traffic Mirroring | CloudTrail plus configuration state. |
| “Was this TCP flow rejected?” | CloudTrail only | VPC Flow Logs or firewall logs. |
| “Need packet-level inspection from selected ENIs” | Flow logs only | VPC Traffic Mirroring with filters and appliance target. |
| “Need organization-wide security group audit” | Manual console review | Firewall Manager, Config, Trusted Advisor, and centralized evidence. |
| “Need near-real-time alarm from log pattern” | Archive only to S3 | CloudWatch Logs metric filter, metric, alarm, or EventBridge. |
| “Need long-term audit retention and Athena queries” | CloudWatch dashboard only | S3-backed central log archive with query strategy. |
| “Need web-layer request details” | VPC Flow Logs only | WAF, CloudFront, or ALB logs. |
A security team needs to prove which IAM principal changed a security group rule that opened inbound TCP/22 to the internet. They also need to confirm whether any traffic was accepted by that rule before it was removed. Which evidence combination is strongest?
Answer: Use CloudTrail for the change and VPC Flow Logs for the traffic evidence.
Why: CloudTrail identifies the API caller, request parameters, and time of the security group change. VPC Flow Logs can show whether traffic matching the relevant flow tuple was accepted or rejected during the exposure window. Neither source alone proves both parts of the question.
For ANS-C01 validation and audit, ask what must be proven. Use CloudTrail for who changed configuration, VPC Flow Logs or firewall logs for flow behavior, Traffic Mirroring for packet-level inspection, CloudFront/WAF/ALB logs for web-layer evidence, CloudWatch for alarms and custom metrics, and Firewall Manager/Config/Trusted Advisor for multi-account posture.
Continue with 4.3 Confidentiality of Network Data and Communications to connect monitoring evidence with encryption, certificates, VPN, TLS, and secure DNS choices.