An Amazon EC2 application in a private subnet intermittently fails to reach an external payment provider, returning connection timeouts, while traffic to other endpoints succeeds. The team suspects packets to the provider are being dropped somewhere in the VPC configuration rather than failing at the application, and they need evidence of whether the traffic is being accepted or rejected and at which point. VPC Flow Logs are already enabled on the relevant network interfaces and delivered to Amazon CloudWatch Logs. Which approach MOST directly confirms where the packets are being dropped?
- AEnable AWS X-Ray on the application and inspect the trace for the outbound call to the payment provider, reading the error annotation on the external segment to confirm the packets are being dropped in the VPC.
- BSearch AWS CloudTrail for any RevokeSecurityGroupEgress or network ACL change events during the failures, treating a recent configuration change as proof that those packets to the provider are now being rejected.
- CCreate an Amazon CloudWatch alarm on the EC2 instance NetworkPacketsOut metric and watch whether it drops during the failures, taking a decline as evidence that the provider traffic is being blocked in the VPC.
- DRun a CloudWatch Logs Insights query over the VPC Flow Logs filtering on the provider destination address and port, then read the action field to see whether records show ACCEPT or REJECT for those flows. Correct
Why A is wrong: X-Ray records that the application call timed out but has no visibility into VPC packet acceptance or rejection, so it confirms a failure without showing whether a security group or ACL dropped the traffic.
Why B is wrong: CloudTrail can reveal a configuration change but not whether individual packets are accepted or rejected, and the timeouts may stem from an existing rule rather than a recent change, so it does not confirm the drop.
Why C is wrong: The NetworkPacketsOut metric is a coarse aggregate of all interface traffic and cannot isolate the flow to one destination or show an ACCEPT or REJECT decision, so it cannot localise where the packets are dropped.
Why D is correct: VPC Flow Log records carry an action field of ACCEPT or REJECT per flow, so filtering the logs to the provider address and port and reading that field directly shows whether a security group or ACL is dropping the packets.