Network Troubleshooting

Every other topic in this domain built something. This one takes it apart when it stops working. A connection times out and you have four plausible suspects, a cache hit ratio collapses with no deployment, a VPN reports available while nothing crosses it. What separates a twenty minute fix from a three hour outage is not knowing more services, it is having an order to work in and knowing which evidence source can actually see the hop you suspect.

What This Topic Covers

• An ordered source-to-destination walk that finds the blocking component instead of guessing, plus Reachability Analyzer and its explanation codes
• Reading VPC flow log records field by field, and the ACCEPT then REJECT pattern that separates a security group denial from a network ACL denial
• The traffic VPC Flow Logs never capture, and when the answer is Transit Gateway Flow Logs, ELB access logs, WAF logs, or Resolver query logs instead
• Querying logs at volume with CloudWatch Logs Insights and Amazon Athena
• CloudFront diagnosis from response headers and result-type fields, the causes behind 403, 502, and 504, and how to find the cache key dimension shredding your hit ratio
• Hybrid links diagnosed bottom up: VPN Phase 1 against Phase 2 against BGP, and Direct Connect layer 1 against layer 2 against layer 3
• The routing and DNS failures that leave a perfectly healthy link carrying no traffic
• Internet Monitor, Network Flow Monitor, and Network Synthetic Monitor, and the per-resource metrics that catch failures nobody reported

Why It Matters

Task 5.3 of the exam is entirely troubleshooting, and its questions are built by breaking exactly one thing in an otherwise correct architecture. The candidates who struggle are the ones who know each service in isolation but have no method for narrowing four suspects down to one. The candidates who pass read the symptom first: a timeout and a connection refused point at different layers, one REJECT record and an ACCEPT then REJECT pair point at different firewalls, a 502 and a 504 point at different halves of the origin connection.

The same discipline is what makes the difference on call. Naming the hop you suspect before you open a console picks your tool for you, and picking correctly is most of the work.