ANS-C01 Question 118
Single answerYour company has a multi-tier application hosted in AWS, where the web tier resides in a public subnet and the database tier resides in a private subnet within the same VPC. Users have reported intermittent connectivity issues when accessing the application. To troubleshoot, you need to determine whether the web servers can communicate with the database servers. Which AWS service and approach should you use to identify potential connectivity issues in the architecture?
- A
Use VPC Reachability Analyzer to analyze network paths between the web tier and database tier.
- B
Enable VPC Flow Logs on the web tier subnet and inspect the logs for dropped packets.
- C
Use AWS Config to monitor configuration changes in the VPC and identify potential connectivity issues.
- D
Deploy an EC2 instance as a network probe and manually test connectivity between the web tier and database tier.
Show answer and explanation
Correct answer: A
Explanation
The VPC Reachability Analyzer is a purpose-built tool that provides visibility into network connectivity between resources in a VPC. It simulates network paths and identifies potential issues, such as missing security group rules, route table entries, or network ACLs. This makes it the ideal choice for troubleshooting connectivity problems in this scenario.
- A. Correct.
VPC Reachability Analyzer is designed to analyze network paths between resources in a VPC, providing detailed insights into potential connectivity issues. This is the most efficient and purpose-built tool for this scenario.
- B. Incorrect.
While enabling VPC Flow Logs can help identify traffic patterns and dropped packets, it does not provide a clear, end-to-end analysis of network paths or pinpoint the exact issue as efficiently as VPC Reachability Analyzer.
- C. Incorrect.
AWS Config is a compliance and configuration monitoring tool. While it can track resource configurations, it is not designed to analyze network connectivity or troubleshoot reachability issues.
- D. Incorrect.
Manually deploying an EC2 instance as a network probe would require significant effort and does not leverage AWS's built-in tools like the VPC Reachability Analyzer, which is more efficient and less error-prone.