Troubleshoot VPC connectivity and interpret networking logs including VPC Flow Logs, Elastic Load Balancing access logs, AWS WAF logs and CloudFront logs.

A global web property is served through Amazon CloudFront with an Application Load Balancer origin. A subset of viewers in one geography report sporadic HTTP 502 responses, and operators must determine for each failed request whether CloudFront failed to obtain a usable response from the origin or whether the load balancer itself returned the error after talking to its targets. The team wants the two log sources that together let them attribute each 502 to the correct tier with the least new tooling. Which two log sources should they enable and examine? (Select TWO.)

• ACloudFront standard access logs delivered to Amazon S3, which record the edge result type and the status CloudFront returned to the viewer for each request, including origin-side failures.check_circle Correct
• BVPC Flow Logs on the load balancer subnets, which record the accepted and rejected IP flows so the team can read the HTTP status code returned for each affected request.
• CAWS CloudTrail management event logs, which record the API calls made against the distribution and the load balancer so each 502 can be traced to the responsible configuration change.
• DElastic Load Balancing access logs from the Application Load Balancer, which record the elb_status_code and target_status_code along with the processing times for each request reaching the origin.check_circle Correct
• EAWS WAF logs from a web ACL on the distribution, which record the rule that matched each request so the team can confirm whether a managed rule blocked the affected viewers.

Why A is correct: CloudFront access logs show the result type and viewer-facing status per request, letting the team see which 502s CloudFront generated because it could not get a usable response from the origin.

Why B is wrong: Flow logs capture IP-level accept and reject actions but contain no HTTP status code, so they cannot attribute a 502 to either the distribution or the load balancer tier.

Why C is wrong: CloudTrail records control-plane API activity, not the data-plane request results, so it never shows the per-request status codes needed to locate where the 502 originated.

Why D is correct: Load balancer access logs expose both the status the load balancer returned and the status its target returned, so the team can tell whether the 502 came from the targets or the balancer.

Why E is wrong: WAF logs explain blocked or allowed requests by rule match, but a 502 is an origin or gateway failure rather than a WAF block, so these logs do not attribute the error to a tier.