VPC Flow Logs record REJECT entries for traffic that is supposed to be allowed. What should you examine?
Show answer and explanation
Answer: B
A REJECT record means the packet was seen and dropped by a stateful or stateless filter, which in a VPC means a security group or a network ACL. Check the security group's inbound and outbound rules for the port and source, and remember that NACLs are stateless, so the ephemeral return traffic needs its own rule. Route tables and gateways affect whether a packet arrives at all, not whether it is recorded as rejected.
Why the other options are wrong
- A. IAM policies govern API authorization and never inspect network packets.
- C. Routing problems produce missing flows or timeouts rather than REJECT entries, because no filter is dropping the packet.
- D. DNS problems cause name resolution failures upstream of the connection attempt and do not create REJECT records for the data flow.
Exam tip. REJECT equals a filter drop: security group or stateless NACL, including the return path.