ANS-C01 Question 227
Select 3You have deployed a multi-tier application in AWS with an ALB (Application Load Balancer) in front of the web tier that communicates with an Auto Scaling group of EC2 instances. The backend tier consists of another Auto Scaling group of EC2 instances behind an NLB (Network Load Balancer). Users report that some API requests fail intermittently. You suspect a connectivity issue between the web tier and the backend tier. Which of the following actions would help you identify the root cause of the problem?
- A
Use AWS Reachability Analyzer to analyze the network connectivity between the web-tier EC2 instances and the backend-tier NLB.
- B
Capture VPC flow logs for the subnets where the web-tier and backend-tier EC2 instances are deployed and analyze the logs for dropped packets.
- C
Use Route Analyzer to verify the route table configurations in the VPC and ensure the correct routes exist between the web tier and the backend tier.
- D
Enable logging on the Application Load Balancer and inspect the logs for any errors or anomalies in the requests.
- E
Run a packet capture on the backend EC2 instances to inspect the traffic arriving from the web tier.
Show answer and explanation
Correct answers: A, B, D
Explanation
To diagnose intermittent connectivity issues in a multi-tier application, AWS-native tools such as Reachability Analyzer, VPC flow logs, and ALB logs provide critical insights into network paths, routing, and traffic anomalies. Reachability Analyzer helps verify network configurations, VPC flow logs identify traffic issues, and ALB logs allow investigation of request-level problems. While packet capture is a valid troubleshooting approach, it is not an AWS-native solution and involves more manual effort.
- A. Correct.
Correct. AWS Reachability Analyzer is designed to analyze network paths and identify configuration issues such as missing routes, security group restrictions, or NACLs that could block traffic.
- B. Correct.
Correct. VPC flow logs provide detailed information about network traffic, including rejected traffic, which can help identify connectivity or security issues.
- C. Incorrect.
Incorrect. Route Analyzer is not an AWS service. The correct tool for verifying routing and network paths in AWS is Reachability Analyzer.
- D. Correct.
Correct. Enabling logging on the Application Load Balancer can help identify any errors or anomalies in the requests being sent to the backend tier.
- E. Incorrect.
Incorrect. While packet capture could provide insights, it is not an AWS-native tool and would require manual setup, making it less practical in this scenario compared to AWS-native solutions.