An EC2 instance cannot connect to an internal Application Load Balancer in the same VPC.
Identify whether a route table, security group, or network ACL blocks the path without making a change.
Which diagnostic feature is most appropriate?
Run a VPC Reachability Analyzer path analysis between the source and destination.
Detailed explanation
DNS queries can be observed, but Resolver logs do not evaluate security groups or network ACLs on the packet path.
DNS queries can be observed, but Resolver logs do not evaluate security groups or network ACLs on the packet path.
The analysis evaluates the configured network path and can identify the control that prevents reachability.
The analysis evaluates the configured network path and can identify the control that prevents reachability.
Authentication auditing is unrelated to packet-path reachability.
Authentication auditing is unrelated to packet-path reachability.
S3 Inventory lists objects and does not analyze VPC network paths.
S3 Inventory lists objects and does not analyze VPC network paths.
Check official documentation
Compare the following points with the official documentation.
VPC Reachability Analyzer path analysisの公式説明を確認する。
What to confirm
DNSログとネットワーク経路分析の役割を区別できる。
Key points
- Reachability Analyzer
- Network path
- Network ACL
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Evidence without change
Path analysis identifies a blocking control while preserving the current configuration.
Layered controls
Routing, security groups, and network ACLs can each affect one end-to-end path.