Exam AWS Certified Advanced Networking - Specialty ANS-C01 topic 1 question 169 discussion

"to capture all alerts and flow logs"

A- https://docs.aws.amazon.com/network-firewall/latest/developerguide/logging-cw-logs.html

Selected Answer: A Only 3 systems can have AWS Network Firewall Log. Amazon Simple Storage Service, Amazon CloudWatch Logs, Amazon Data Firehose.

Selected Answer: B A: Since only all alerts are captured, the requirement to capture all traffic logs cannot be met. B: The Network Firewall log settings are configured for logging from the Network Firewall's Firewall Details screen. When configuring the logging settings, select either the alert log or the traffic log, or both, and configure the output settings. C: The requirement is not met because alerts cannot be captured. D: Network Firewall alerts and traffic logs cannot be captured by CloudTrail.

B - is the only Answer that correctly mentions both alert logs and flowlogs which are 2 different log types the network firewall can be configured to log. A - seems like a good answer as it mentions sending the logs to a cloudwatch log group, but where the logs are sent is not part of the question and so as A only mentions alert logs, it's incorrect.

AWS Network Firewall is integrated with AWS CloudTrail, a service that provides a record of API calls to Network Firewall by a user, role, or an AWS service. CloudTrail captures all API calls for Network Firewall as events. The calls captured include calls from the Network Firewall console and code calls to the Network Firewall API operations. If you create a trail, you can enable continuous delivery of CloudTrail events to an Amazon S3 bucket, including events for Network Firewall. If you don't configure a trail, you can still view the most recent events in the CloudTrail console in Event history. Using the information collected by CloudTrail, you can determine information including the request that was made to Network Firewall, the IP address from which the request was made, who made the request, and when the request was made.

logging destinations are s3, cloudwatch, or data firehose https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-logging-destinations.html