CloudTrail watches the control plane (API), Config watches configuration state. But "what actual packets flowed where" neither sees. VPC Flow Logs fills the gap. Flow Logs record metadata (5-tuple, bytes, accept/reject) of IP traffic entering/leaving ENI (Elastic Network Interface). They do not capture packet payload — that's Traffic Mirroring's domain.
For security exams, Flow Logs are primary evidence for "detecting anomalous traffic," "diagnosing security group/NACL misconfiguration," "detecting data exfiltration," and "tracking denied connections."