DVA-C02 · Question #493
A developer is troubleshooting a three-tier application, which is deployed on Amazon EC2 instances. There is a connectivity problem between the application servers and the database servers. Which AWS
The correct answer is C. Amazon VPC Flow Logs D. Network access control lists. VPC Flow Logs capture IP traffic metadata at the network interface level, and Network ACLs enforce stateless allow/deny rules at the subnet boundary, together providing visibility and control to diagnose EC2 connectivity issues.
Question
A developer is troubleshooting a three-tier application, which is deployed on Amazon EC2 instances. There is a connectivity problem between the application servers and the database servers. Which AWS services or tools should be used to identity the faulty component? (Choose two.)
Options
- AAWS CloudTrail
- BAWS Trusted Advisor
- CAmazon VPC Flow Logs
- DNetwork access control lists
- EAWS Config rules
How the community answered
(49 responses)- A6% (3)
- B4% (2)
- C76% (37)
- E14% (7)
Why each option
VPC Flow Logs capture IP traffic metadata at the network interface level, and Network ACLs enforce stateless allow/deny rules at the subnet boundary, together providing visibility and control to diagnose EC2 connectivity issues.
CloudTrail logs AWS API calls and management events, not network-level packet flow between EC2 instances.
Trusted Advisor provides best-practice recommendations across cost, security, and performance, but does not diagnose specific network connectivity faults.
VPC Flow Logs record accepted and rejected traffic at the ENI, subnet, or VPC level, allowing the developer to see whether packets between application and database servers are being allowed or dropped.
Network ACLs are stateless firewall rules applied at the subnet level; reviewing their inbound and outbound rules can reveal if a misconfigured DENY rule is blocking traffic between the application and database subnets.
AWS Config rules evaluate resource configuration compliance over time but do not capture or analyze real-time network traffic or connectivity failures.
Concept tested: Network connectivity troubleshooting with VPC Flow Logs and NACLs
Source: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html
Community Discussion
No community discussion yet for this question.