[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cheat-sheet---en":3,"domain-info---en":3,"topic-info----en":3,"lesson-aws-certified-cloudops-engineer-associate-networking-content-delivery-network-troubleshooting-analyzing-network-logs-en":4,"next-aws-certified-cloudops-engineer-associate-networking-content-delivery-network-troubleshooting-analyzing-network-logs-en":20,"prev-aws-certified-cloudops-engineer-associate-networking-content-delivery-network-troubleshooting-analyzing-network-logs-en":31},null,{"locked":5,"reason":6,"meta":7,"item":3},true,"paywall",{"title":8,"description":9,"isFree":10,"estimatedMinutes":11,"difficulty":12,"learningObjectives":13},"Analyzing Network Logs","VPC Flow Logs, ELB access logs, CloudFront logs, WAF logs, and Resolver query logs each watch a different hop of the same request. This lesson teaches you to read each one and to pick the right one before you start querying.",false,30,"intermediate",[14,15,16,17,18,19],"Match a failing hop to the log source that can actually see it","Read a VPC flow log record field by field, including the version 3 to 5 fields worth adding to a custom format","Separate a security group denial from a network ACL denial using the ACCEPT and REJECT pattern in flow logs","Explain what VPC Flow Logs never capture and why a missing record is not evidence of missing traffic","Interpret the three ALB latency fields and the -1 values that replace them when a request fails","Query flow logs with CloudWatch Logs Insights and Athena to find rejected traffic and top talkers",{"locked":5,"reason":6,"meta":21,"item":3},{"title":22,"description":23,"isFree":10,"estimatedMinutes":24,"difficulty":12,"learningObjectives":25},"Troubleshooting CloudFront Issues","A CloudFront error can come from the viewer, the edge, or your origin, and the status code alone will not tell you which. This lesson teaches you to read the response headers and log fields that do, and to fix a collapsing cache hit ratio.",28,[26,27,28,29,30],"Determine whether a CloudFront response was generated by the edge or by the origin using response headers and log fields","Interpret x-edge-result-type, x-edge-response-result-type, and x-edge-detailed-result-type together","Diagnose a low cache hit ratio by finding the cache key dimension that is fragmenting the cache","Work through the common causes of CloudFront 403, 502, and 504 responses in the order that resolves them fastest","Choose between raising cache TTLs, adding Origin Shield, and invalidating, based on what the evidence shows",{"locked":10,"reason":3,"meta":32,"item":42},{"title":33,"description":34,"isFree":5,"estimatedMinutes":35,"difficulty":12,"learningObjectives":36},"Troubleshooting VPC Connectivity","A connection inside a VPC can fail at seven different places, and guessing wastes the outage. This lesson gives you an ordered walk down the path plus Reachability Analyzer, the tool that reads the whole path for you.",26,[37,38,39,40,41],"Apply an ordered source-to-destination walk to any VPC connectivity failure instead of checking components at random","Distinguish a security group failure from a network ACL failure from a route table failure by the symptom each one produces","Use Reachability Analyzer to test a path from configuration, and read its explanation codes","Identify the cases where Reachability Analyzer cannot answer the question and a live test is required","Recognize the failures that present as network problems but are caused by DNS, MTU, or source/destination check",{"id":43,"title":33,"body":44,"description":34,"difficulty":12,"estimatedMinutes":35,"extension":732,"infographics":733,"isFree":5,"learningObjectives":748,"meta":749,"navigation":5,"path":750,"quiz":751,"seo":830,"stem":831,"__hash__":832},"courses/courses/aws-certified-cloudops-engineer-associate/en/domains/05-networking-content-delivery/05-network-troubleshooting/01-troubleshooting-vpc-connectivity.md",{"type":45,"value":46,"toc":723},"minimark",[47,51,54,59,62,67,114,117,120,124,127,179,186,190,193,200,211,375,378,399,403,406,550,559,563,566,607,614,618,621,635,641,647,653,657,716,719],[48,49,50],"p",{},"An application server in a private subnet cannot open a connection to an RDS instance in the same VPC. The database is running, the credentials are unchanged, and the connection just times out. You have four suspects and no evidence: a security group, a network ACL, a route table, and the possibility that the database is not listening at all.",[48,52,53],{},"Most engineers start clicking through the console in whatever order the tabs happen to be in. That works eventually. It also burns the first twenty minutes of an outage on components that were never involved. The skill this lesson teaches is not memorizing more services. It is walking the path in the order a packet walks it, so that the first thing you find wrong is actually the thing that broke.",[55,56,58],"h2",{"id":57},"the-path-has-an-order-and-so-should-you","The path has an order, and so should you",[48,60,61],{},"A packet leaving an EC2 instance passes through a fixed sequence of gates. Every one of them can deny it, and each denial looks identical from the application: a timeout. So work the sequence, not your intuition.",[63,64],"infographic",{"alt":65,"slug":66},"A left-to-right diagram of a packet path from a source instance to a destination, with 7 numbered checkpoints on the line in order: source security group, source network ACL, source route table, the intermediate gateway, destination network ACL, destination security group, and the resource policy, with a return arrow above the line.","vpc-connectivity-ordered-walk",[68,69,70,78,84,90,96,102,108],"ol",{},[71,72,73,77],"li",{},[74,75,76],"strong",{},"Source security group, outbound."," Does an egress rule allow the destination address and port? Default groups allow all outbound, so this is only a suspect in a locked-down environment. When it is the cause, it is because someone replaced the default egress rule and forgot a port.",[71,79,80,83],{},[74,81,82],{},"Source subnet network ACL, outbound."," Does an outbound rule allow the request, and does an inbound rule allow the reply on ephemeral ports? Network ACLs are stateless, so both directions are separate questions.",[71,85,86,89],{},[74,87,88],{},"Source route table."," Is there a route whose destination CIDR contains the target address, and does its target exist and work? No route means the packet is dropped before any firewall is consulted.",[71,91,92,95],{},[74,93,94],{},"The intermediate."," NAT gateway, internet gateway, VPC endpoint, peering connection, or transit gateway. Each has its own failure modes, and each was covered in the earlier topics of this domain.",[71,97,98,101],{},[74,99,100],{},"Destination subnet network ACL, inbound."," Same stateless pair of questions from the far side.",[71,103,104,107],{},[74,105,106],{},"Destination security group, inbound."," Does an ingress rule allow the source, whether by CIDR or by referencing the source's security group?",[71,109,110,113],{},[74,111,112],{},"The resource policy."," An endpoint policy, an S3 bucket policy, or a service-side policy can reject a request whose packets arrived perfectly. This one produces an error rather than a timeout, which is a useful signal on its own.",[48,115,116],{},"Then walk the return path. That sounds like a formality until you meet the failure it catches: the request is accepted, the destination replies, and the reply is denied by an outbound network ACL rule that nobody thought about because the application only ever initiates in one direction.",[48,118,119],{},"The reason this order pays is that each gate hides the ones behind it. If the route table has no match, the security group at the far end could be wide open or closed and you would never know. Checking in path order means the first denial you find is the one that matters, and everything after it is noise.",[55,121,123],{"id":122},"read-the-symptom-before-you-read-the-config","Read the symptom before you read the config",[48,125,126],{},"Three of the failures above produce distinguishable symptoms if you look at the right thing.",[128,129,130,143],"table",{},[131,132,133],"thead",{},[134,135,136,140],"tr",{},[137,138,139],"th",{},"Symptom",[137,141,142],{},"What it usually means",[144,145,146,155,163,171],"tbody",{},[134,147,148,152],{},[149,150,151],"td",{},"Connection times out with no response at all",[149,153,154],{},"A security group, a network ACL, or a missing route silently dropped the packet",[134,156,157,160],{},[149,158,159],{},"Connection refused immediately",[149,161,162],{},"The packet arrived and the destination host sent a TCP RST, so nothing in the network blocked it and the service is not listening on that port",[134,164,165,168],{},[149,166,167],{},"Connects, then hangs on large transfers",[149,169,170],{},"Path MTU problem, not a permission problem",[134,172,173,176],{},[149,174,175],{},"Immediate 403 or AccessDenied from the service",[149,177,178],{},"The network path is fine and an IAM, bucket, or endpoint policy denied the call",[48,180,181,182,185],{},"That second row deserves its own sentence, because it saves entire investigations. ",[74,183,184],{},"A \"connection refused\" error means the network worked."," The SYN reached the host, the host had nothing listening on that port, and it answered honestly. No security group produces that error, because a security group denial produces silence. When an application logs connection refused, stop looking at the VPC and go look at whether the process is running and bound to the address you think it is.",[55,187,189],{"id":188},"reachability-analyzer-reads-the-whole-path-for-you","Reachability Analyzer reads the whole path for you",[48,191,192],{},"Walking seven gates by hand across two accounts takes real time. Reachability Analyzer does it in one call.",[48,194,195,196,199],{},"The important thing to understand about it is what it actually looks at. ",[74,197,198],{},"It builds a model of your network configuration and reasons over that model. It does not send packets and it does not touch the data plane."," So it can tell you that a security group would drop this traffic, and it can tell you the exact hop-by-hop path a permitted packet would take, without any traffic existing at all. That is why it works on a resource that is completely broken, and why it works before you deploy anything real.",[48,201,202,203,206,207,210],{},"You define a ",[74,204,205],{},"path",": a source, a destination, and optionally a protocol, a destination port, and intermediate components to include or exclude. Then you run an ",[74,208,209],{},"analysis"," on that path. Supported sources and destinations are EC2 instances, internet gateways, network interfaces, transit gateways, transit gateway attachments, virtual private gateways, VPC endpoint services, VPC endpoints, and VPC peering connections, plus a plain IP address as a destination.",[212,213,218],"pre",{"className":214,"code":215,"language":216,"meta":217,"style":217},"language-bash shiki shiki-themes material-theme-lighter github-light github-dark","# 1. Define the path once\naws ec2 create-network-insights-path \\\n  --source i-0a1b2c3d4e5f67890 \\\n  --destination i-09876fedcba543210 \\\n  --destination-port 3306 \\\n  --protocol tcp\n\n# 2. Run an analysis against it, as often as you like\naws ec2 start-network-insights-analysis \\\n  --network-insights-path-id nip-0abc123def456789a\n\n# 3. Read the verdict and the explanations\naws ec2 describe-network-insights-analyses \\\n  --network-insights-analysis-ids nia-0abc123def456789a \\\n  --query 'NetworkInsightsAnalyses[0].[NetworkPathFound,Explanations]'\n","bash","",[219,220,221,230,248,260,271,283,292,298,304,316,325,330,336,348,359],"code",{"__ignoreMap":217},[222,223,226],"span",{"class":224,"line":225},"line",1,[222,227,229],{"class":228},"sutJx","# 1. Define the path once\n",[222,231,233,237,241,244],{"class":224,"line":232},2,[222,234,236],{"class":235},"sbgvK","aws",[222,238,240],{"class":239},"s_sjI"," ec2",[222,242,243],{"class":239}," create-network-insights-path",[222,245,247],{"class":246},"s_hVV"," \\\n",[222,249,251,255,258],{"class":224,"line":250},3,[222,252,254],{"class":253},"stzsN","  --source",[222,256,257],{"class":239}," i-0a1b2c3d4e5f67890",[222,259,247],{"class":246},[222,261,263,266,269],{"class":224,"line":262},4,[222,264,265],{"class":253},"  --destination",[222,267,268],{"class":239}," i-09876fedcba543210",[222,270,247],{"class":246},[222,272,274,277,281],{"class":224,"line":273},5,[222,275,276],{"class":253},"  --destination-port",[222,278,280],{"class":279},"srdBf"," 3306",[222,282,247],{"class":246},[222,284,286,289],{"class":224,"line":285},6,[222,287,288],{"class":253},"  --protocol",[222,290,291],{"class":239}," tcp\n",[222,293,295],{"class":224,"line":294},7,[222,296,297],{"emptyLinePlaceholder":5},"\n",[222,299,301],{"class":224,"line":300},8,[222,302,303],{"class":228},"# 2. Run an analysis against it, as often as you like\n",[222,305,307,309,311,314],{"class":224,"line":306},9,[222,308,236],{"class":235},[222,310,240],{"class":239},[222,312,313],{"class":239}," start-network-insights-analysis",[222,315,247],{"class":246},[222,317,319,322],{"class":224,"line":318},10,[222,320,321],{"class":253},"  --network-insights-path-id",[222,323,324],{"class":239}," nip-0abc123def456789a\n",[222,326,328],{"class":224,"line":327},11,[222,329,297],{"emptyLinePlaceholder":5},[222,331,333],{"class":224,"line":332},12,[222,334,335],{"class":228},"# 3. Read the verdict and the explanations\n",[222,337,339,341,343,346],{"class":224,"line":338},13,[222,340,236],{"class":235},[222,342,240],{"class":239},[222,344,345],{"class":239}," describe-network-insights-analyses",[222,347,247],{"class":246},[222,349,351,354,357],{"class":224,"line":350},14,[222,352,353],{"class":253},"  --network-insights-analysis-ids",[222,355,356],{"class":239}," nia-0abc123def456789a",[222,358,247],{"class":246},[222,360,362,365,369,372],{"class":224,"line":361},15,[222,363,364],{"class":253},"  --query",[222,366,368],{"class":367},"sjJ54"," '",[222,370,371],{"class":239},"NetworkInsightsAnalyses[0].[NetworkPathFound,Explanations]",[222,373,374],{"class":367},"'\n",[48,376,377],{},"Three operational facts about it are worth carrying:",[379,380,381,387,393],"ul",{},[71,382,383,386],{},[74,384,385],{},"You are charged per analysis run",", not per path, so the path object is free to keep and re-run after every change. That is what makes it useful as a regression check and not just an incident tool.",[71,388,389,392],{},[74,390,391],{},"Source and destination must be in the same Region",", and in the same VPC or in VPCs connected by peering or a transit gateway. They may be in different accounts in the same AWS Organizations organization if you enable trusted access.",[71,394,395,398],{},[74,396,397],{},"Analyses are deleted automatically 120 days after creation."," If a result is evidence for an audit, export it.",[55,400,402],{"id":401},"explanation-codes-name-the-guilty-component","Explanation codes name the guilty component",[48,404,405],{},"When a path is not reachable, the analysis returns one or more explanation codes. You do not need to memorize the full list, but recognizing the families turns a wall of output into a one-line diagnosis.",[128,407,408,418],{},[131,409,410],{},[134,411,412,415],{},[137,413,414],{},"Code",[137,416,417],{},"What it is telling you",[144,419,420,430,440,450,460,470,480,490,500,510,520,530,540],{},[134,421,422,427],{},[149,423,424],{},[219,425,426],{},"NO_ROUTE_TO_DESTINATION",[149,428,429],{},"The route table has no applicable route to the destination",[134,431,432,437],{},[149,433,434],{},[219,435,436],{},"MORE_SPECIFIC_ROUTE",[149,438,439],{},"A route exists but a longer prefix match sends the traffic elsewhere",[134,441,442,447],{},[149,443,444],{},[219,445,446],{},"SUBNET_ACL_RESTRICTION",[149,448,449],{},"The subnet's network ACL does not admit the traffic in that direction",[134,451,452,457],{},[149,453,454],{},[219,455,456],{},"ENI_SG_RULES_MISMATCH",[149,458,459],{},"The security group has no inbound or outbound rule that applies",[134,461,462,467],{},[149,463,464],{},[219,465,466],{},"SG_HAS_NO_RULES",[149,468,469],{},"The security group has no rules at all",[134,471,472,477],{},[149,473,474],{},[219,475,476],{},"ENI_SOURCE_DEST_CHECK_RESTRICTION",[149,478,479],{},"Source/destination check is rejecting forwarded traffic",[134,481,482,487],{},[149,483,484],{},[219,485,486],{},"ELBV2_NO_TARGETS_IN_AZ",[149,488,489],{},"The load balancer has no targets in the Availability Zone in question",[134,491,492,497],{},[149,493,494],{},[219,495,496],{},"TGW_ATTACH_MISSING_TGW_RTB_ASSOCIATION",[149,498,499],{},"The transit gateway attachment is not associated with any route table",[134,501,502,507],{},[149,503,504],{},[219,505,506],{},"TGW_ROUTE_AZ_RESTRICTION",[149,508,509],{},"The transit gateway is not registered in the Availability Zone the traffic starts from",[134,511,512,517],{},[149,513,514],{},[219,515,516],{},"PCX_REQUIRES_ADDRESS_IN_VPC_CIDR",[149,518,519],{},"The peering connection cannot carry an address outside the peer VPC's CIDR",[134,521,522,527],{},[149,523,524],{},[219,525,526],{},"FIREWALL_RULES_RESTRICTION",[149,528,529],{},"A matching Network Firewall rule blocked it",[134,531,532,537],{},[149,533,534],{},[219,535,536],{},"DISCONNECTED_VPCS",[149,538,539],{},"The two VPCs are not connected by any supported resource at all",[134,541,542,547],{},[149,543,544],{},[219,545,546],{},"NO_PATH",[149,548,549],{},"No path was found, commonly because of an unsupported feature such as IPv6",[48,551,552,553,555,556,558],{},"Two of those codes teach something beyond their own message. ",[219,554,436],{}," is the routing lesson restated as a diagnosis: your route is present and correct and still unused, because something longer matched first. And ",[219,557,496],{}," is the association-versus-propagation distinction from the transit gateway lesson showing up as a concrete failure, since an attachment that propagates routes but is associated with nothing has no route table to consult.",[55,560,562],{"id":561},"where-the-model-stops-and-the-packets-start","Where the model stops and the packets start",[48,564,565],{},"Reachability Analyzer is a configuration checker, so it is blind to everything that is not configuration. Knowing its blind spots is what keeps a green result from misleading you.",[379,567,568,574,583,589,595,601],{},[71,569,570,573],{},[74,571,572],{},"It does not consider the health of registered targets."," A load balancer whose targets are all failing health checks will still analyze as reachable.",[71,575,576,579,580,582],{},[74,577,578],{},"It supports only IPv4."," If a resource has both address families, only the IPv4 side is analyzed. An IPv6-only failure shows up as ",[219,581,546],{},".",[71,584,585,588],{},[74,586,587],{},"It has no view of DNS."," If your application resolves a name to the wrong address, the path to the right address is still perfectly reachable.",[71,590,591,594],{},[74,592,593],{},"It stops at transit gateway Connect attachments",", and paths through a Gateway Load Balancer endpoint exclude the Gateway Load Balancer and its targets, which need their own analysis.",[71,596,597,600],{},[74,598,599],{},"Network Firewall support is partial."," It handles stateful and stateless 5-tuple rules, but not domain lists, Suricata rules, rule options, or tag-based resource groups, and it says so in the path details when it meets one.",[71,602,603,606],{},[74,604,605],{},"It says nothing about the application."," A listening process, a TLS handshake, a database that rejects the credentials: all outside the model.",[48,608,609,610,613],{},"So the honest rule is: ",[74,611,612],{},"Reachability Analyzer proves the path is permitted, not that the call will succeed."," When it says not reachable, you have your answer and you can stop. When it says reachable and the application still fails, you have learned something valuable too, which is that the problem is above the network layer, and the next lesson's logs are where you go.",[55,615,617],{"id":616},"the-failures-that-are-not-really-network-failures","The failures that are not really network failures",[48,619,620],{},"Four causes account for a large share of the tickets that arrive labeled \"VPC connectivity\" and never touch a security group.",[48,622,623,626,627,630,631,634],{},[74,624,625],{},"DNS resolving to the wrong thing."," A private hosted zone needs ",[219,628,629],{},"enableDnsSupport"," and ",[219,632,633],{},"enableDnsHostnames"," on the VPC to be usable, and an interface endpoint with private DNS disabled leaves the public service name resolving to a public address that a private subnet cannot reach. The connection fails at the network layer, but the fix is a DNS setting.",[48,636,637,640],{},[74,638,639],{},"Path MTU."," A connection that opens cleanly and then stalls the moment a large payload starts is almost never a permission problem. Handshakes are small and fit anywhere. Tunnels reduce the usable packet size, and if a firewall drops the ICMP fragmentation-needed messages, path MTU discovery cannot tell the sender to send smaller packets, so the transfer just hangs. Check MTU before you check rules whenever the symptom depends on size.",[48,642,643,646],{},[74,644,645],{},"Source/destination check."," Any instance forwarding traffic on behalf of others, such as a NAT instance or an appliance, must have this disabled. Left on, the interface discards forwarded packets and everything about the routing looks correct.",[48,648,649,652],{},[74,650,651],{},"Ephemeral ports on a stateless network ACL."," Covered in full in the security groups lesson, and it keeps reappearing here because it is the single most common reason a network ACL allows the request and kills the reply. If the traffic is outbound and the network ACL's inbound rules do not allow 1024 to 65535 back in, nothing works and every rule reads as reasonable.",[55,654,656],{"id":655},"exam-tips","Exam tips",[379,658,659,665,671,677,683,699,705,710],{},[71,660,661,664],{},[74,662,663],{},"Ordered walk, every time."," Source security group, source network ACL, route table, intermediate, destination network ACL, destination security group, resource policy, then the return path. Scenario questions are built by breaking exactly one of these.",[71,666,667,670],{},[74,668,669],{},"\"Connection refused\" is not a network problem."," Timeout means dropped, refused means delivered. A question that says the client gets an immediate refusal is pointing at the service, not the VPC.",[71,672,673,676],{},[74,674,675],{},"Reachability Analyzer analyzes configuration, not packets."," When a question asks how to find the blocking component without generating traffic or changing anything, this is the answer. When it asks what actually happened to real traffic, it is flow logs.",[71,678,679,682],{},[74,680,681],{},"Reachability Analyzer is IPv4 only, same Region, and ignores target health."," Those three constraints are the most likely thing an exam question tests about it.",[71,684,685,698],{},[74,686,687,630,689,691,692,694,695,697],{},[219,688,436],{},[219,690,426],{}," are routing; ",[219,693,446],{}," is the network ACL; ",[219,696,456],{}," is the security group."," Being able to map a code to a component is enough.",[71,700,701,704],{},[74,702,703],{},"Overlapping CIDRs cannot be peered",", because the local route always wins inside your own VPC CIDR and cannot be overridden.",[71,706,707],{},[74,708,709],{},"Forwarding appliance plus silent drops equals source/destination check.",[71,711,712,715],{},[74,713,714],{},"Stalls only on big transfers equals MTU",", not firewalls.",[48,717,718],{},"The habit to carry out of this lesson is smaller than the tool list: when a connection fails, name the first gate on the path that you have not verified, and check that one. Reachability Analyzer is how you do that walk in one call instead of seven. What it cannot tell you is what actually happened to real traffic last Tuesday at 03:00, and that is what the next lesson's logs are for.",[720,721,722],"style",{},"html pre.shiki code .sutJx, html code.shiki .sutJx{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#6A737D;--shiki-default-font-style:inherit;--shiki-dark:#6A737D;--shiki-dark-font-style:inherit}html pre.shiki code .sbgvK, html code.shiki .sbgvK{--shiki-light:#E2931D;--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .s_sjI, html code.shiki .s_sjI{--shiki-light:#91B859;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .s_hVV, html code.shiki .s_hVV{--shiki-light:#90A4AE;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .stzsN, html code.shiki .stzsN{--shiki-light:#91B859;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .srdBf, html code.shiki .srdBf{--shiki-light:#F76D47;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sjJ54, html code.shiki .sjJ54{--shiki-light:#39ADB5;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":217,"searchDepth":250,"depth":250,"links":724},[725,726,727,728,729,730,731],{"id":57,"depth":232,"text":58},{"id":122,"depth":232,"text":123},{"id":188,"depth":232,"text":189},{"id":401,"depth":232,"text":402},{"id":561,"depth":232,"text":562},{"id":616,"depth":232,"text":617},{"id":655,"depth":232,"text":656},"md",[734],{"slug":66,"concept":735,"style":736,"aspectRatio":737,"labels":738},"A single left-to-right path from a source EC2 instance to a destination resource, drawn as one horizontal line with 7 numbered checkpoints sitting on it in the exact order a packet meets them. Each checkpoint is a labeled gate on the line, not a box floating beside it, so the order is the visual argument. Above the line, a small return arrow doubles back from the destination to the source to mark the return path as a separate question. The takeaway strip at the bottom states the rule that decides the walk.","diagram","16:9",[739,740,741,742,743,744,745,746,747],"1. Source security group: outbound rule allows the destination and port","2. Source subnet network ACL: outbound rule allows it, and inbound allows the reply","3. Source route table: a route matches the destination and points at a live target","4. The intermediate: NAT gateway, internet gateway, endpoint, peering, or transit gateway","5. Destination subnet network ACL: inbound allows the request, outbound allows the reply","6. Destination security group: inbound rule allows the source and port","7. The resource policy: endpoint policy, bucket policy, or service policy","Return path: the reply travels back through the same 7 gates and can fail on its own","Walk the path in order. The first gate that denies is the answer, and every later gate is a distraction.",[37,38,39,40,41],{},"/courses/aws-certified-cloudops-engineer-associate/en/domains/05-networking-content-delivery/05-network-troubleshooting/01-troubleshooting-vpc-connectivity",{"passingScore":752,"questions":753},70,[754,763,771,782,790,796,804,812,820],{"question":755,"type":756,"options":757,"correctAnswer":759,"explanation":762},"An EC2 instance in a private subnet cannot open a connection to an RDS database in the same VPC. You want to find the blocking component without changing anything or logging in to the instance. Which tool answers the question directly?","single",[758,759,760,761],"VPC Flow Logs, because they record the packets that were rejected","Reachability Analyzer, because it models the configured path and names the blocking component","Traffic Mirroring to a packet capture appliance","CloudWatch Network Flow Monitor with agents on both hosts","Reachability Analyzer builds a model of the network configuration and reports the component blocking the path, without sending a single packet. Flow logs are useful but only show what already happened, so they are silent when the source never got a packet out. Traffic Mirroring and Network Flow Monitor both require the traffic to actually flow, which is the thing that is failing.",{"question":764,"type":756,"options":765,"correctAnswer":769,"explanation":770},"Reachability Analyzer returns a result of not reachable with the explanation code SUBNET_ACL_RESTRICTION. What does that tell you?",[766,767,768,769],"The subnet has no route to the destination","The security group attached to the instance has no rules","The subnet is in an Availability Zone the destination does not support","The network ACL for the subnet does not admit the traffic in the direction being analyzed","SUBNET_ACL_RESTRICTION points at the network ACL, and the direction matters because network ACLs are stateless and evaluate the request and the reply separately. NO_ROUTE_TO_DESTINATION is the route table code, SG_HAS_NO_RULES and ENI_SG_RULES_MISMATCH are the security group codes, and TGW_ROUTE_AZ_RESTRICTION is one of the Availability Zone codes.",{"question":772,"type":773,"options":774,"correctAnswers":780,"explanation":781},"Which statements about Reachability Analyzer are correct? (Choose 2.)","multiple",[775,776,777,778,779],"It analyzes the configuration model rather than sending live packets","It considers the health of registered load balancer targets","It supports only resources with an IPv4 address","It works across Regions as long as the VPCs are peered","It replaces the need for VPC Flow Logs during an incident",[775,777],"Reachability Analyzer reasons about configuration, not the data plane, and it includes only IPv4 addresses even when a resource also has IPv6. It explicitly does not consider target health, and source and destination must be in the same Region, which is why a green result and a broken application can coexist and flow logs still matter.",{"question":783,"type":756,"options":784,"correctAnswer":786,"explanation":789},"A subnet route table has 0.0.0.0/0 pointing at a NAT gateway and 10.0.0.0/16 as the local route. An instance in that subnet cannot reach 10.0.5.20 in a peered VPC whose CIDR is 10.0.0.0/16. What is happening?",[785,786,787,788],"The peering connection is in a failed state","The local route matches first because overlapping CIDRs make the peering unusable, so the traffic never leaves the VPC","The NAT gateway is translating the address to a public IP","The network ACL is dropping the reply on the ephemeral port","The local route always wins for addresses inside the VPC CIDR and cannot be overridden, so two VPCs with the same or overlapping CIDR can be peered in name only. AWS rejects a peering request between overlapping CIDRs for exactly this reason. Nothing about the NAT gateway or the network ACL changes a routing decision that was already made locally.",{"question":791,"type":756,"options":792,"correctAnswer":793,"explanation":795},"True or False: if a security group blocks the traffic, VPC Flow Logs show one REJECT record, and if a network ACL blocks the reply, the logs show an ACCEPT record followed by a REJECT record.",[793,794],"True","False","A security group is stateful, so a denied inbound packet never reaches the interface and produces a single REJECT. A network ACL is stateless and evaluates each direction on its own, so the request can be accepted and logged as ACCEPT while the reply is denied and logged as REJECT. That ACCEPT then REJECT pair is the fastest way to tell the two apart in a log.",{"question":797,"type":756,"options":798,"correctAnswer":799,"explanation":803},"A firewall appliance instance is forwarding traffic for other subnets, but packets it forwards are silently dropped. Every route table and security group is correct. What is the most likely cause?",[799,800,801,802],"The instance has source/destination check enabled","The instance is in a subnet with no internet gateway route","The instance type does not support enhanced networking","The instance needs an Elastic IP address","Source/destination check makes an interface reject any packet whose source or destination is not one of its own addresses, which is the normal safety default and exactly wrong for anything routing on behalf of others. Reachability Analyzer reports this as ENI_SOURCE_DEST_CHECK_RESTRICTION. Enhanced networking and Elastic IP addresses change performance and public addressing, not whether a forwarded packet is accepted.",{"question":805,"type":756,"options":806,"correctAnswer":809,"explanation":811},"You are asked to verify that an internet gateway can reach an EC2 instance on port 443, but the path you want to test crosses the internet gateway in the middle. Reachability Analyzer returns IGW_NAT_REFLECTION. What should you do?",[807,808,809,810],"Enable cross-account analysis on the path","Re-run the analysis with TCP instead of the default protocol","Split it into two analyses: source to the internet gateway, then the internet gateway to the destination","Add the internet gateway as an excluded intermediate component","Reachability Analyzer does not support an internet gateway as an intermediate hop because address translation happens there, so it asks you to analyze each side separately. Cross-account analysis solves a different problem, which is a path whose components live in another account in the same organization. Changing the protocol or excluding the component does not restore a hop the tool cannot model.",{"question":813,"type":756,"options":814,"correctAnswer":818,"explanation":819},"An application connects fine to small API responses but hangs whenever a large file transfer starts over a Site-to-Site VPN. Reachability Analyzer reports the path as reachable. What should you investigate?",[815,816,817,818],"The security group on the destination, since large transfers use different ports","A route table entry that only matches short flows","The network ACL rule numbers, since lower numbers apply to small packets first","Path MTU: the tunnel reduces the usable packet size, and blocked ICMP prevents path MTU discovery from working","A handshake and small responses fit inside any MTU, so a connection that opens and then stalls on bulk transfer is the signature of an MTU problem, usually made invisible by a firewall dropping the ICMP fragmentation-needed messages. Reachability Analyzer models configuration and will happily call the path reachable. No security group, route, or network ACL rule distinguishes traffic by transfer size.",{"question":821,"type":773,"options":822,"correctAnswers":828,"explanation":829},"Which of these are true about how you should order a manual VPC connectivity investigation? (Choose 2.)",[823,824,825,826,827],"Check the return path separately, because a stateless network ACL can allow the request and deny the reply","Start with the destination security group, since inbound rules are the most common cause","Confirm the route table has a matching route before spending time on firewall rules, because no route means the packet never leaves","Assume DNS is fine if the destination resolves from your laptop","Check the resource policy first, because it is evaluated before the network path",[823,825],"An ordered walk moves with the packet, so routing comes before the far-end firewall, and the return path gets its own pass because network ACLs are stateless. Starting at the destination security group works sometimes and wastes the outage the rest of the time. Resolution from your laptop says nothing about a private hosted zone inside the VPC, and a resource policy is evaluated at the service after the packet arrives, not before it leaves.",{"title":33,"description":34},"courses/aws-certified-cloudops-engineer-associate/en/domains/05-networking-content-delivery/05-network-troubleshooting/01-troubleshooting-vpc-connectivity","NtCLNd6MLk06n6b-9o_lgzGRFmU0hS_WfeCG-PJ9yfU"]