SCS-C02 Question 266
Select 3Your organization has been experiencing network connectivity issues between an EC2 instance in a private subnet and an on-premises server connected via AWS Site-to-Site VPN. You need to identify the root cause and verify if there are any configuration issues, such as security group rules, network ACLs, route tables, or VPN connectivity. Which tools can you use to analyze and troubleshoot this reachability issue effectively?
- A
Use VPC Reachability Analyzer to simulate and analyze the network path between the EC2 instance and the on-premises server.
- B
Use Amazon Inspector to scan the EC2 instance for any misconfigurations in its operating system or installed applications.
- C
Manually inspect the security groups, network ACLs, and route tables associated with the VPC to identify misconfigurations.
- D
Use AWS CloudTrail to review API calls related to security group modifications or routing changes.
- E
Use the AWS Trusted Advisor Networking checks to validate reachability between resources.
Show answer and explanation
Correct answers: A, C, D
Explanation
To troubleshoot network connectivity issues, tools like VPC Reachability Analyzer are highly effective in simulating and analyzing the network path to identify misconfigurations. Manually inspecting the security groups, network ACLs, and route tables can also reveal issues affecting connectivity. Additionally, AWS CloudTrail can help track recent changes to network configurations. Amazon Inspector and Trusted Advisor are not designed for detailed network connectivity analysis in this scenario.
- A. Correct.
Correct. VPC Reachability Analyzer can simulate the network path and identify configuration issues such as security group, route table, or network ACL misconfigurations.
- B. Incorrect.
Incorrect. Amazon Inspector is primarily used for vulnerability scanning and compliance checks, not for network reachability analysis.
- C. Correct.
Correct. Manually inspecting the security groups, network ACLs, and route tables is a valid approach to troubleshoot connectivity issues.
- D. Correct.
Correct. AWS CloudTrail can help identify if recent API calls modified security groups, routes, or other configurations affecting connectivity.
- E. Incorrect.
Incorrect. AWS Trusted Advisor provides general best practice checks but does not offer detailed reachability analysis for specific network paths.