ANS-C01 Question 271
Select 2Your organization has a VPC with a public and private subnet. Resources in the private subnet are unable to reach an on-premises network connected via an AWS Direct Connect connection. You want to troubleshoot this issue using AWS-provided tools. Which of the following approaches can help identify and resolve the connectivity problem? (Choose TWO.)
- A
Use Reachability Analyzer to test the path from a private subnet instance to the on-premises network and identify potential issues.
- B
Use Route Analyzer to validate the routing table configurations for the private subnet and ensure routes to the on-premises network are defined.
- C
Check AWS CloudTrail logs to confirm if the traffic from the private subnet instance is being dropped due to a security group misconfiguration.
- D
Enable Amazon VPC Flow Logs for the private subnet and analyze the logs to verify if traffic is being sent and received correctly.
- E
Use AWS Trusted Advisor to identify the misconfigured route tables for the private subnet.
Show answer and explanation
Correct answers: A, B
Explanation
To troubleshoot connectivity issues from the private subnet to the on-premises network, you should use tools specifically designed to analyze network paths and routing configurations. Reachability Analyzer provides insights into the network path and identifies misconfigurations, while Route Analyzer ensures route tables are set up correctly. Other tools like CloudTrail and Trusted Advisor are not designed for this level of network troubleshooting, and while VPC Flow Logs can provide traffic data, they are not sufficient for directly diagnosing routing or connectivity issues.
- A. Correct.
Correct: Reachability Analyzer is a tool designed to trace and analyze specific network paths to identify misconfigurations or blockages, making it an appropriate choice for this situation.
- B. Correct.
Correct: Route Analyzer validates routing table configurations and can confirm if the private subnet has the necessary routes to reach the on-premises network.
- C. Incorrect.
Incorrect: CloudTrail logs are primarily used for auditing API activity, not for troubleshooting network connectivity.
- D. Incorrect.
Incorrect: While VPC Flow Logs can help in diagnosing network traffic issues, they do not directly identify routing or connectivity misconfigurations.
- E. Incorrect.
Incorrect: AWS Trusted Advisor is useful for identifying high-level best practices but does not provide detailed analysis of route table configurations.