SOA-C02 Question 285
Select 4A company has configured a Site-to-Site VPN connection between their on-premises data center and their VPC on AWS using a Virtual Private Gateway. However, users are reporting intermittent connectivity issues when accessing resources in the VPC. As a SysOps Administrator, what steps should you take to troubleshoot the issue?
- A
Verify the VPN tunnel status in the AWS Management Console and check if the tunnels are up.
- B
Ensure that the Security Groups and Network ACLs attached to the VPC subnets allow traffic from the on-premises network.
- C
Check the on-premises router's configuration to ensure the pre-shared key and the IKE (Internet Key Exchange) settings match the VPN configuration on AWS.
- D
Analyze the CloudTrail logs to verify if unauthorized access is causing the connectivity issue.
- E
Use VPC Flow Logs to analyze the network traffic between the on-premises network and the VPC.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To troubleshoot hybrid connectivity issues, it is important to verify the VPN tunnel status, check network configurations such as Security Groups, Network ACLs, and router settings, and analyze network traffic using tools like VPC Flow Logs. These steps help isolate and resolve the root cause of the issue. CloudTrail logs, while useful for security analysis, are not directly applicable to diagnosing connectivity problems.
- A. Correct.
Correct: The VPN tunnel status provides critical information about the connectivity between the on-premises data center and AWS. If the tunnels are down, the VPN connection will not function correctly.
- B. Correct.
Correct: Security Groups and Network ACLs control inbound and outbound traffic to resources in the VPC. Misconfigured rules can block traffic from the on-premises network, resulting in connectivity issues.
- C. Correct.
Correct: The configuration on the on-premises router must match the AWS VPN configuration, including the pre-shared key and IKE settings. Mismatches can cause intermittent or failed connections.
- D. Incorrect.
Incorrect: While CloudTrail logs are useful for monitoring API activity and detecting unauthorized access, they are not directly relevant to troubleshooting hybrid connectivity issues.
- E. Correct.
Correct: VPC Flow Logs help analyze network traffic and can provide insights into whether packets from the on-premises network are reaching the VPC and vice versa.