AWS Certified Advanced Networking – Specialty (ANS-C01)Network Management and OperationsMedium
A large multinational enterprise uses a hub-and-spoke network topology in AWS, with a central Transit Gateway in a shared services VPC. They have hundreds of spoke VPCs connected to this Transit Gateway. The network operations team frequently needs to troubleshoot routing issues and verify connectivity between specific EC2 instances in different spoke VPCs. Manually checking route tables and security groups for each path is time-consuming and error-prone. What is the most efficient AWS service to quickly visualize and diagnose potential network path issues across this complex environment?
- AVPC Reachability Analyzer
- BAmazon CloudWatch Network Insights
- CAWS Network Manager Route Analyzer
- DVPC Flow Logs with Amazon Athena
Show answer & explanationAnswer & explanation
Correct answer: A. VPC Reachability Analyzer
VPC Reachability Analyzer is a network diagnostics tool that enables you to analyze and debug network reachability between two resources in your VPCs. It verifies if a path exists and identifies problematic network configurations, including security groups, network ACLs, route tables, and Transit Gateway attachments, making it ideal for this complex hub-and-spoke scenario.
Why the other options are wrong
- B. Amazon CloudWatch Network Insights is not a standard AWS service name. CloudWatch provides metrics and logs, but not a dedicated path analysis tool like Reachability Analyzer.
- C. AWS Network Manager Route Analyzer (a feature of Network Manager) is used to analyze routes within and across Transit Gateways and VPNs, but VPC Reachability Analyzer provides a more comprehensive, end-to-end path analysis including security groups and NACLs.
- D. VPC Flow Logs with Amazon Athena can analyze traffic patterns but cannot proactively diagnose network path blockages or misconfigurations in real-time like Reachability Analyzer can.
VPC Reachability Analyzer
A network diagnostics tool that helps you analyze and debug network reachability between two resources in your VPCs, identifying configuration issues.
- Verifies path existence
- Identifies blocking components (SGs, NACLs, Route Tables)
- Supports inter-VPC and Transit Gateway paths
Memory trick: Reachability Analyzer: Your network's GPS, finding and fixing blocked routes.