What does this small section of a CloudFormation template do?

flowLog:
  Type: AWS::EC2::flowLog
  Properties:
    DeliverLogsPermissionArn: !GetAtt IamRole.Arn
    LogGroupName: flowLogsGroup
    ResourceId: !Ref LogVpcId
    ResourceType: VPC
    TrafficType: ALL

1.  It writes the VPC network flow logs to the CloudWatch flowLogsGroup log group. You could use this to inspect the network connections of your VPC.
2.  It logs all of the network traffic within a VPC except Instance IDs defined by LogVpcID and logs it to the CloudWatch flowLogsGroup log group.
3.  It logs all the network traffic going to and from a single EC2 instance into the CloudWatch flowLogsGroup log group. You could use this to inspect suspicious network traffic coming into an EC2 instance.
4.  It logs all of the DNS requests made by resources within a VPC and logs them to the CloudWatch flowLogsGroup. Use this to diagnose DNS lookup errors within your environment.

Correct Answer:

•  It writes the VPC network flow logs to the CloudWatch flowLogsGroup log group. You could use this to inspect the network connections of your VPC.